Jacobian group element adder

ABSTRACT

An objective is to obtain a Jacobian group element adder that can calculate addition in a Jacobian group of a C ab  curve at a high speed, and can enhance practicality of the C ab  curve. 
     An algebraic curve parameter file A  10 , and Groebner bases I 1  and I 2  of ideals of a coordinate ring of an algebraic curve designated by this file A are input into an ideal composition section  11  to perform arithmetic of producing a Groebner basis J of an ideal product of the ideal generated by I1 and ideal generated by I2. In a first ideal reduction section  12 , arithmetic is performed of producing a Groebner basis J* of an ideal that is smallest in a monomial order designated by the file A among ideals equivalent to an inverse ideal of an ideal that J in the coordinate ring of the algebraic curve designated by the file A generates. In a second ideal reduction section  13 , arithmetic is performed of producing a Groebner basis J** of a ideal that is smallest in the monomial order designated by the file A among ideals equivalent to an inverse ideal of an ideal that this J* generates to output it.

BACKGROUND OF THE INVENTION

The present invention relates to a Jacobian group element adder, and more particularly technology for discrete logarithmic cryptography employing a Jacobian group of an algebraic curve (hereinafter, referred to as algebraic curve cryptography) that is a kind of the discrete logarithmic cryptography, which is cryptography technology as information security technology.

It is an elliptic curve cryptography that has come in practice most exceedingly among the algebraic curve cryptography. However, an elliptic curve for use in the elliptic curve cryptography is a very special one as compared with a general algebraic curve. There is the apprehension that an aggressive method of exploiting its specialty would be discovered in the near future. For this, so as to secure safety more reliably, a general algebraic curve of which specialty is lower is desirably employed. C_(ab) curve cryptography is known as an algebraic curve cryptography capable of employing a more general algebraic curve as mentioned above.

The C_(ab) curve cryptography, however, is less employed in the industrial field as compared with the elliptic curve cryptography. Its main reason is that the conventional additive algorithm in the Jacobian group of the conventional C_(ab) curve is tens of times slower than additive algorithm in the Jacobian group of the elliptic curve, and as a result, process efficiency of encryption/decryption in the C_(ab) curve cryptography is remarkably inferior as compared with the elliptic curve cryptography, which was shown in “Jacobian Group Additive algorithm of C_(ab) Curve and its Application to Discrete Logarithmic Cryptography” by Seigo Arita, Japanese-version collection of The Institute of Electronics, Information and Communication Engineers, Vol. J82-A, No.8, pp.1291–1299, 1999.

Also, another additive algorithm in the Jacobian group of the C_(ab) curve was proposed in “A Fast Jacobian Group Arithmetic Scheme for Algebraic Curve Cryptography” by Ryuichi Harasawa, and Joe Suzuki, Vol. E84-A No.1, pp.130–139, 2001 as well; however, even though an asymptotic calculation quantity of algorithm was given, no execution speed data in a packaging experiment was shown, and, also, no report on the packaging experiment by a third party was provided, and the extent to which the execution speed can practically be achieved is uncertain.

As seen from the foregoing, non-efficiency of the additive algorithm in the Jacobian group of the C_(ab) curve prevents the cryptography of the above curve from coming in practice, which gives rise to the necessity of executing addition in the Jacobian group of the C_(ab) curve at a high speed.

DISCLOSURE OF THE INVENTION

The present invention has been accomplished in consideration of such problems, and an objective thereof is to provide a Jacobian group element adder that enables the additive algorithm in the Jacobian group of the c_(ab) curve to be executed at a high speed.

The Jacobian group element adder in accordance with the present invention, which is an arithmetic unit for executing addition in a Jacobian group of an algebraic curve defined by a polynomial defined over a finite field that is Y³+α₀X⁴+α₁XY²+α₂X²Y+α₃X³+α₄Y²+α₅XY+α₆X²+α₇Y+α₈X+α₉ or Y²+α₀X⁵+α₁X²Y+α₂X⁴+α₃XY+α₄X³+α₅Y+α₆X²+α₇X+α₈ or Y²+α₀X⁷+α₁X³Y+α₂X⁶+α₃X²Y+α₄X⁵+α₅XY+α₆X⁴+α₇Y+α₈X³+α₉X²+α₁₀X+α₁₁, is characterized in comprising:

means for inputting an algebraic curve parameter file having an order of a field of definition, a monomial order, and a coefficient list described as a parameter representing said algebraic curve;

means for inputting Groebner bases I₁ and I₂ of ideals of the coordinate ring of the algebraic curve designated by said algebraic curve parameter file, which represent elements of said Jacobian group;

ideal composition means for, in the coordinate ring of the algebraic curve designated by said algebraic curve parameter file, performing arithmetic of a producing Groebner basis J of the ideal which is a product of the ideal that the Groebner basis I₁ generates, and the ideal that the Groebner basis I₂ generates;

first ideal reduction means for, in the coordinate ring of the algebraic curve designated by said algebraic curve parameter file, performing arithmetic of producing a Groebner basis J* of the ideal, which is smallest in the monomial order designated by said algebraic curve parameter file among the ideals equivalent to an inverse ideal of the ideal that the Groebner basis J generates; and

second ideal reduction means for, in the coordinate ring of the algebraic curve designated by said algebraic curve parameter file, performing arithmetic of producing a Groebner basis J** of the ideal, which is smallest in the monomial order designated by said algebraic curve parameter file among the ideals equivalent to an inverse ideal of the ideal that the Groebner basis J* generates to output it.

[C_(ab) Curve and its Jacobian Group]

The C_(ab) curve C to be treated in the present invention is a nonsingular plane curve to be defined by a polynomial F(X,Y) having the following formula for two natural numbers a and b that are relatively prime. F(X,Y)=Y ^(a) +c ₀ X ^(b) +Σc _(i,j) X ^(i) Y ^(j)

Here, indexes i and j in the above equation, which are natural numbers equal to or more than zero, vary in a range of ai+bj<ab. Also, suppose that c₀ and c_(i,j) are elements of a defining field k, and that c₀ is not zero. The C_(ab) curve C has a unique point at infinity P_(∞), and the polynomials Y and X have a unique b-order pole and a-order pole at P_(∞) respectively. Set a group subtended by divisors of degree 0 on the C_(ab) curve C to D_(c) ⁰(k), and set a group composed of principal divisors to P_(c)(k).

A Jacobian group J_(c)(k) of which the additive algorithm is required to be found in the present invention is defined as J _(c)(k)=D _(c) ⁰(k)/P _(c)(k)

On the other hand, let R=k[X,Y]/F be the coordinate ring of the C_(ab) curve C, it follows that the ring R becomes an integrally-closed integral domain, which is a Dedekind domain, because the C_(ab) curve C is nonsingular by definition. Thus, all of the fractional ideals of the ring R that is not zero compose a group I_(R)(k). Set a subgroup by subtended by the principal ideal of the ring R to P_(R)(k), then an ideals class group H_(R)(k) of the ring R is defined as H _(R)(k)=I _(R)(k)/P _(R)(k)

As a rule, it is known that, for the nonsingular algebraic curve, the divisor on the curve can be identified with the ideal of the coordinate ring, and that its Jacobian group and the ideal class group are of intrinsic isomorphism. In particular, a Jacobian group J_(C)(k) of the C_(ab) curve C and the ideal class group H_(R)(k) of the coordinate ring R are of intrinsic isomorphism. The ideal is more convenient than the divisor for packaging algorithm, whereby, hereinafter, the Jacobian group J_(C)(k) of the C_(ab) curve C is treated as the ideal class group H_(R)(k) of the coordinate ring R.

[Preparation Relating to a Groebner Basis]

Since the Groebner basis of the ideal is employed in calculation of which an object is the ideal class group H_(R)(k), a preparation relating hereto is made in this chapter. As a rule, for a polynomial ring S=k[X₁, . . . , X_(n)], an order ‘<’ among its monomials, if it is compatible with a product, that is, M₁<M₂ always yields M1M3, is called a monomial order. In this chapter, from now on, suppose an arbitrary monomial order ‘<’ is given to a polynomial ring S.

For a polynomial f in S, call the largest monomial in the monomial order ‘<’ that appears in f a leading monomial of f, which is denoted by LM(f). Also, for an ideal I, LM(I) denotes an ideal that is generated by leading monomials of the polynomial belonging to I generates by LM(I).

For an ideal I=(f₁, . . . , f_(s)) of S that is generated by a polynomials f₁, . . . , f_(s), when {f₁, . . . , f_(s)} meets IM(I)=(LM(f₁), . . . , LM(f_(s))), {f₁, . . . , f_(s)} is called a Groebner basis of the ideal I. For the ideal I of the polynomial ring S, the entirety Δ(I) of the monomial (or its multi degree) Δ(I) that does not belong to LM(I) is called a delta set of I. When (multi degrees of) monomials in Δ(I) are plotted, a convex set appears, and a lattice point encircling its convex set corresponds to the leading monomial of an element of the Groebner basis of I. Also, Δ(I) subtends the basis of a vector space S/I over k.

The ideal I of an the coordinate ring R=S/F of a nonsingular affine algebraic curve C can be identified with the ideal of the polynomial ring S that includes a defining ideal F of the curve C. Thus, for the ideal of the coordinate ring R as well, as mentioned above, Groebner basis can be considered. For a zero-dimensional ideal I (that is, a set of zeros of I is a finite set) of the coordinate ring R=S/F, call a dimension of a vector space S/I over k an order of the ideal I, which is denoted by δ(I). Immediately from definition, it can be seen that δ(I) is equivalent to the order of the set Δ(I). Also, by assumption of being nonsingular, it follows that δ(IJ)=δ(I)δ(J). When I=(f) is a principal ideal of R, then δ(I)=−v_(P∞)(f), where v_(P∞)(f) represents a valuation of the polynomial f at P_(∞).

[Additive Algorithm on Jacobian Group of C_(ab) Curve, Part 1]

Now think about the coordinate ring R=k[X,Y]/F of the C_(ab) curve C defined by the polynomial F(X,Y). Regard the monomial of two variables X^(m)Y^(n) as a function on the curve C, and call the monomial order obtained by ordering the monomials based on the size of a pole order-v_(P∞)(X^(m)Y^(n)) at P_(∞) a C_(ab) order. Here, in the case that the pole orders at P_(∞) thereof are the same, the monomial with the larger is supposed to be larger. Hereinafter, the C_(ab) order is employed as the monomial order of the coordinate ring R of the C_(ab) curve C. For the ideal I of the coordinate ring R, let f_(I) be the non-zero polynomial with the smallest leading monomial among the polynomials in I. Furthermore, let I*=(f_(I)):I(={g∈R|g·I⊂(f_(I))}).

Now, it can be easily shown that, when I and J are arbitrary (integral) ideals of the coordinate ring R, then (1) I and I** are linearly equivalent, (2) I**, which is an (integral) ideal equivalent to I, has the smallest order among ideals equivalent to I, and (3) if I and J are equivalent, then I*=J*, in particular, J**=(I**)**. For an ideal I of the coordinate ring R, when I**=(I), we call I a reduced ideal. From the above-mentioned equations (1) and (3), an arbitrary ideal is equivalent to the unique reduced ideal. That is, the reduced ideals compose a representative system of the ideal classes. This property is not limited to the C_(ab) order, and holds also in the event of having employed an arbitrary monomial order; however, in the event of having employed the C_(ab) order, from the above-mentioned equation (2), the reduced ideal has the property of becoming an ideal of which the order is the smallest among the equivalent ideals. This is advantageous in packaging the algorithm. Using reduced ideal as a representative system of the ideal classes, we obtain additive algorithm on Jacobian of C_(ab) curve, mentioned below.

[Additive Algorithm on Jacobian Group 1]

Inputs: reduced ideals I₁ and I₂ of the coordinate ring R

Output: a reduced ideal I₃ equivalent to an ideal product I₁·I₂

-   1. J←I₁·I₂ -   2. J*←(f_(J)):J -   3. I₃←(f_(J*)):J*     [Classification of Ideals]

So as to realize the above-mentioned additive algorithm on Jacobian group 1 as a program that is efficient, and yet is easy to package, the ideals that appear during execution of the additive algorithm 1 are classified. Hereinafter, for simplification, explanation is made with a C₃₄ curve (that is, the C_(ab) curve with a=3, and b=4) taken as an object; however, for the general C_(ab) curve as well, the matter is similar. A genus of the C₃₄ curve is 3, whereby the order of the ideal that appears during execution of the additive algorithm 1 is equal to or less than 6. The Groebner bases in their C₃₄ orders are classified as follows order by order. However, from now on, even though a defining equation F of the C₃₄ curve C appears in the Groebner basis of the ideal, F is omitted, and is not expressed. Also, coefficients a_(i), b_(j), and c_(k) of each polynomial constructing the Groebner basis are all elements of k.

(Ideal of Order 6)

Suppose I is an ideal of order 6 of the coordinate ring R. By definition of the order, V=R/I is a six-dimensional vector space over the defining field k. When six points that the ideal I represents are at a “generalized” position, six monomials from the beginning in the C₃₄ order 1, X, Y, X², XY, and Y² are linearly independent at these six points. That is, the monomials 1, X, Y, X², XY, and Y² compose a basis of the vector space V. At this time, we call such an ideal I an ideal of a type 61.

As a rule, a delta set Δ(I) of the ideal I can be identified with the basis of the vector space V, whereby the delta set of the ideal I of a type 61 becomes Δ(I)={(0,0),(1,0),(0,1),(2,0),(1,1),(0,2)} The lattice points encircling these are (0,3),(1,2),(2,1),(3,0)}. Thus, the Groebner basis of the ideal I of a type 61 takes the following form.

The Groebner basis of the ideal of a type 61={X³+a₆Y²+a₅XY+a₄X²+a₃Y+a₂X+a₁,X²Y+b₆Y²+b₅XY+b₄X²+b₃Y+b₂X+b₁, XY²+c₆Y²+c₅XY+c₄X²+c₃Y+c₂X+c₁}

These three polynomials correspond to the lattice points (3,0), (2,1), and (1,2) respectively (The lattice point (0,3) corresponds to the defining equation F). As a rule, six monomials 1, X, Y, X², XY, and Y² are not always linearly independent at the six points that the ideal I represents, i.e. in the vector space V.

So, next, we study the case in which five monomials from the beginning in the C₃₄ order 1, X, Y, X², and XY are linearly independent in V, and the sixth monomial Y² is represented by a linear combination of them. By assumption, Δ(I) is a convex set of order 6 that includes {(0,0),(1,0),(0,1),(2,0),(1,1)}, and does not include (2,0). Thus, it becomes either of Δ(I)={(0,0),(1,0),(0,1),(2,0),(1,1),(2,1)}, or Δ(I)={(0,0),(1,0),(0,1),(2,0),(1,1),(3,0)}. When Δ(I) is the former, call I an ideal of a type 62, and in the event that it is the latter, call I an ideal of type 63.

The lattice point set encircling Δ(I) is {(0,2),(3,0)} when I is of type 62, and is (0,2),(2,1),(4,0)} when I is of type 63. Thus, the Groebner basis becomes the following. The Groebner basis of the ideal of a type 62={Y²+a₅XY+a₄X²+a₃Y+a₂X+a₁,X³+b₅XY+b₄X²+b₃Y+b₂X+b₁}

These two polynomials correspond to the lattice points (0,2), and (3,0) respectively.

The Groebner basis of the ideal of a type 63={Y²+a₅XY+a₄X²+a₃Y+a₂X+a₁,X²Y+b₆X³+b₅XY+b₄X²+b₃Y+b₂X+b₁}

These two polynomials correspond to the lattice points (0,2), and (2,1) respectively.

Although the polynomial, which corresponds to the lattice point (4,0), originally exists in the Groebner basis of the ideal of a type 63; it was omitted since from the defining equation F, and an equation f=Y²+a₅XY+a₄X²+a₃Y+a₂X+a₁ that corresponds to the lattice point (0,2), it can be immediately calculated as F−Yf.

Next, suppose four monomials from the beginning 1, X, Y, and X² are linearly independent in V, and that the fifth monomial XY is represented by a linear combination thereof. That is, Δ(I) includes {(0,0),(1,0),(0,1),(2,0)}, and does not include (1,1).Here, assume Δ(I) does not includes (0,2), then there is no other choice but Δ(I)=(0,0),(1,0),(0,1),(2,0),(3,0),(4,0)} so that Δ(I) has order 6. As it is, by assumption, I includes a polynomial f=Y²+ . . . of which the leading term is Y². As a result, (4,0) does not belong to Δ(I) because Yf−F=X⁴+ . . . belongs to I. That is contradictory. From the foregoing, it can be seen that Δ(I) is sure to include (0,2), then Δ(I)={(0,0),(1,0),(0,1),(2,0),(0,2),(3,0)}. At this time, call I an ideal of a type 64.

The lattice point set encircling the delta set Δ(I) of the ideal I of a type 64 is {(0,3),(1,1),(4,0)}. Thus the Groebner basis of the ideal I of a type 64 becomes the following.

The Groebner basis of the ideal of a type 64={XY+a₄X²+a₃Y+a₂X+a₁,X⁴+b₆X³+b₅Y²+b₄X²+b₃Y+b₂X+b₁}

These two equations correspond to the lattice points (1,1), and (4,0) respectively (The lattice point (0,3) corresponds to the defining equation F).

Next, suppose three monomials from the beginning 1, X, and Y in the C₃₄ order are linearly independent in V=R/I, and that the fourth monomial X² is represented by a linear combination thereof. At this time, since a polynomial f of which the leading term is X² is included in the ideal I, the delta set becomes Δ(I)={(0,0),(1,0),(0,1),(1,1),(0,2),(1,2)} and the lattice point set encircling these becomes {(0,3),(2,0)}, whereby I becomes a monomial ideal to be generated in f. At this time, call I an ideal of a type 65.

The Groebner basis of the ideal of a type 65={X²+a₃Y+a₂X+a₁}

The above equation corresponds to the lattice point (2,0) (The lattice point (0,3) corresponds to the defining equation F)

There is no possibility that, from deg((f)₀)=−v_(p∞) (f)=4<6, the polynomial f of which the leading term is (a term equal to or lower than) Y disappears simultaneously at six points that correspond to the ideal I of order 6. Thus, three monomials 1, X, and Y from the beginning are always linearly independent in V=R/I, and above, the classification of the ideal of order 6 was completed.

(Ideal of Order 5)

Suppose I is an ideal of order 5 of coordinate ring R. The ideal of order 5 is also classified into a type 51 to a type 54 similarly to the ideal of order 6, as mentioned below.

The Groebner basis of the ideal of a type 51={Y²+a₅XY+a₄X²+a₃Y+a₂X+a₁,X³+b₅XY+b₄X²+b₃Y+b₂X+b₁, X²Y+c₅XY+c₄X²+c₃Y+c₂X+c₁}

The Groebner basis of the ideal of a type 52={XY+a₄X²+a₃Y+a₂X+a₁,Y²+b₄X²+b₃Y+b₂X+b₁}

The Groebner basis of the ideal of a type 53={XY+a₄X²+a₃Y+a₂X+a₁,X³+b₅Y²+b₄X²+b₃Y+b₂X+b₁}

The Groebner basis of the ideal of a type 54={X²+a₃Y+a₂X+a₁,XY²+b₅Y²+b₄XY+b₃Y+b₂X+b₁}

(Ideal of Order 4)

The ideal I of order 4 is also classified into a type 41 to a type 44 similarly, as mentioned below.

The Groebner basis of the ideal of a type 41={XY+a₄X²+a₃Y+a₂X+a₁,Y²+b₄X²+b₃Y+b₂X+b₁,X³+c₄X²+c₃Y+c₂X+c₁}

The Groebner basis of the ideal of a type 42={X²+a₃Y+a₂X+a₁,XY+b₃Y+b₂X+b₁}

The Groebner basis of the ideal of a type 43={X²+a₃Y+a₂X+a₁,Y²+b₄XY+b₃Y+b₂X+b₁}

The Groebner basis of the ideal of a type 44={Y+a₂X+a₁}

(Ideal of Order 3)

The ideal I of order 3 is also classified into a type 31 to a type 33 similarly, as mentioned below.

The Groebner basis of the ideal of a type 31={X²+a₃Y+a₂X+a₁,XY+b₃Y+b₂X+b₁,Y²+c₃Y+c₂X+c₁}

The Groebner basis of the ideal of a type 32={Y+a₂X+a₁,X³+b₃X²+b₂X+b₁}

The Groebner basis of the ideal of a type 33={X+a₁}

(Ideal of Order 2)

The ideal I of order 2 is also classified into a type 21 and a type 22 similarly, as mentioned below.

The Groebner basis of the ideal of a type 21={Y+a₂X+a₁,X²+b₂X+b₁}

The Groebner basis of the ideal of a type 22={X+a₁,Y²+b₂Y+b₁}

(Ideal of Order 1)

Needless to say, the ideal of order 1 is only of type 11, as mentioned below.

The Groebner basis of the ideal of a type 11={X+a₁,Y+b₁}

[Remark]

Ideals of a type 65, 44, and 33 among the ideals mentioned above, which are a principal ideal, represent a unit element as a Jacobian group element. Also, the reduced ideal types among the ideal types mentioned above are only 31, 21, 22, and 11. For example, the reason why the ideal of a type 32 is not a reduced one is understood in a manner mentioned below.

Suppose I is an ideal of a type 32, then f_(I)=Y+a₂X+a₁, thus δ(I*)=−v_(∞)(f_(I))−δ(I)=4−3=1, thus, f_(I*)=X+a′, and δ(I**)=−v_(∞)(f_(I*))−δ(I*)=3−1=2 because I* is of type 11. The order thereof is different, whereby I≠I**.

[Additive Algorithm on Jacobian Group of the C₃₄ Curve, Part 2]

Set the coordinate ring of the C₃₄ curve C defined over a field k having the defining equation F to R=k[X,Y]/F. Now let the additive algorithm 1 take concrete shape more clearly for estimating its execution speed. However, hereinafter, the order of the field k is supposed to be sufficiently large in consideration of an application to the discrete logarithmic cryptography.

(Composition Operation 1)

At first, study a first step of the additive algorithm 1 for different ideals I₁ and I₂, which is hereinafter referred to as a composition operation 1. That is, f_(J) is to be found for an ideal product J=I₁·I₂. To this end, the Groebner basis of the ideal product J should be found (since f_(J) is its first element). The genus of the C₃₄ curve is 3, whereby the order of the ideal I1 or I2 is equal to or less than 3. Thus, its type is anyone of 11, 21, 22, 31, and 32. The case is mentioned here in which both of the ideals I₁ and I₂ are of type 31; however the other case is also similar.

We can Suppose I₁ and I₂ are selected at random from the Jacobian group, Then we have at almost every case, V(I ₁)∩V(I ₂)=φ  (1) Because the order of the field k is supposed to be sufficiently large. Here for the ideal I, a set of zero of I is denoted by V(I) (φ represents an empty set). Also in the event that the condition (1) is not met, upon generating element R₁ and R₂ that yields R₁+R₂=0, and calculating (I₁+R₁)+(I₂+R₂) instead of (I₁+I₂), then it boils down to the case in which the condition (1) holds. Also, the case is very rare (a probability of 1/q or something like it when the size of the defining field k is taken as q) in which the condition (1) is not met, whereby only the case in which the condition (1) is met should be considered in evaluating efficiency of the algorithm. Thereupon, hereinafter, assume that I₁ and I₂ meet the condition (1).

Suppose J=I₁I₂ is a product of I₁ and I₂ in R. I₁ and I₂ are both ideals of order 3, whereby the order of J becomes 6. Thus, the type of J is anyone of 61, 62, 63, 64, and 65. So as to decide which the type of J is, a linear relation should be found in a residue ring R/J among ten monomials 1, X, Y, X², XY, Y², X³, X²Y, XY² and X⁴  (2)

An ideal I_(i)(i=1,2) is of type 31, whereby

$\begin{matrix} {{{R/I_{i}} \cong {{k \cdot 1} \oplus {k \cdot X} \oplus {k \cdot Y}}}\left. m\mspace{25mu}\mapsto\mspace{59mu} v_{m}^{(i)} \right.} & \left\lbrack {{EQ}.\mspace{14mu} 1} \right\rbrack \end{matrix}$

From the condition (1), it follows that

$\begin{matrix} {{{R/J} \cong {{R/I_{1}} \oplus {R/I_{2}}} \cong {\oplus_{i = 1}^{6}k}}\left. m\mapsto\left( {{m\;{{mod}\left( I_{i} \right)}},{m\;{{mod}\left( I_{2} \right)}}} \right)\mapsto{v_{m}^{(1)}:v_{m}^{(2)}} \right.} & \left\lbrack {{EQ}.\mspace{14mu} 2} \right\rbrack \end{matrix}$ where v⁽¹⁾ _(m):v⁽²⁾ _(m) is a six-dimensional vector over k to be obtained by connecting two vectors v^((i)) _(m)(i=1,2). Thus, so as to find a linear relation in R/J among ten monomials m_(i) in the equation (2), an intra-row linear relation of the following 10×6 matrix M_(c) should be found with vectors v⁽¹⁾ _(mi):v⁽²⁾ _(mi)(i=1, 2, . . . , 10) taken as a row.

$\begin{matrix} {M_{C} = \begin{pmatrix} {v_{1}^{(1)}:v_{1}^{(2)}} \\ {v_{X}^{(1)}:v_{X}^{(2)}} \\ {v_{Y}^{(1)}:v_{Y}^{(2)}} \\ {v_{X^{2}}^{(1)}:v_{X^{2}}^{(2)}} \\ {v_{XY}^{(1)}:v_{XY}^{(2)}} \\ {v_{Y^{2}}^{(1)}:v_{Y^{2}}^{(2)}} \\ {v_{X^{3}}^{(1)}:v_{X^{3}}^{(2)}} \\ {v_{X^{2}Y}^{(1)}:v_{X^{2}Y}^{(2)}} \\ {v_{X\; Y^{2}}^{(1)}:v_{X\; Y^{2}}^{(2)}} \\ {v_{X^{4}}^{(1)}:v_{X^{4}}^{(2)}} \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 3} \right\rbrack \end{matrix}$

As well known, the intra-row linear relation of the matrix M_(c) is obtained by triangulating a matrix M_(c) with row-reducing transformation, and this allows a type of the ideal J and its Groebner basis to be obtained. The details will be described in embodiments.

(Remark)

In the event that the condition (1) does not hold for the ideals I₁ and I₂, the rank of the matrix M_(c) becomes equal to or less than 5. In calculating the ideal product of I₁ and I₂, at first, assume that they meet the condition (1) for calculation, and as a result of the row-reducing transformation, if it becomes clear that the rank of the matrix M_(c) is equal to or less than 5, then the elements R₁ and R₂ that yields R₁+R₂=0 should be generated to calculate (I₁+R₁)+(I₂+R₂) instead of I₁+I₂.

(Composition Operation 2)

Now study a first step of the additive algorithm 1 for the same ideals I₁=I, and I₂=I of the coordinate ring R=k[X,Y]/F, which is hereinafter referred to as a composition operation 2. That is, for an ideal product J=I₂, its Groebner basis is to be found for calculation of f_(J). The case is mentioned in which the ideal I is of type 31; however the other case is also similar. The order of the field k is supposed to be sufficiently large, whereby no multiple point exists in V(I) in almost every case. (3)

Also, in evaluating efficiency of the algorithm, only the case should be considered in which the condition (3) is met. Hereinafter, assume that I meets the condition (3). J=I² is still an ideal of order 6, whereby, so as to calculate its Groebner basis, a linear relation should be found in the residue ring R/J among the monomials of the equation (1). The ideal I is of type 31, whereby

$\begin{matrix} {{{R/I} \cong {{k \cdot 1} \oplus {k \cdot X} \oplus {k \cdot Y}}}\left. m\mspace{25mu}\mapsto\mspace{59mu} v_{m} \right.} & \left\lbrack {{EQ}.\mspace{11mu} 4} \right\rbrack \end{matrix}$

Also, from the condition (3), the necessary and sufficient condition for causing the polynomial f(∈R) to belong to J=I² is f∈I,f_(X)F_(Y)−f_(Y)F_(X)∈I (Here, for the polynomial f, f_(X) denotes a differential of f with regard to X. As to f_(Y) as well, the matter is similar.) Thus,

$\begin{matrix} {{{R/J} \cong {{R/I} \oplus {R/I}} \cong {\oplus_{i = 1}^{6}k}}\;\left. m\mapsto\left( {{m\;{{mod}(I)}},{{m_{X}F_{Y}} - {m_{Y}F_{X}{{mod}(I)}}}} \right)\mapsto{v_{m}:v_{({{m_{X}F_{Y}} - {m_{Y}F_{X}}})}} \right.} & \left\lbrack {{EQ}.\mspace{14mu} 5} \right\rbrack \end{matrix}$

Where, v_(m):v_((mX FY−mY FX)) is a six-dimensional vector over k to be obtained by connecting two vectors v_(m) and v_((mX FY−mY FX)). After all, so as to find the above-mentioned linear relation, for ten monomials m_(i) in the equation (1), a intra-row linear relation should be found of the following 10×6 matrix M_(D) mentioned below with a six-dimensional vector v_(mi):v_((miX FY−miY FX)) over k taken as a row.

$\begin{matrix} {M_{C} = \begin{pmatrix} {v_{1}:0} \\ {v_{X}:v_{(F_{Y})}} \\ {v_{Y}:v_{({- F_{X}})}} \\ {v_{X^{2}}:v_{({2\; F_{Y}X})}} \\ {v_{X\; Y}:v_{({{{- F_{X}}X} + {F_{Y}Y}})}} \\ {v_{Y^{2}}:v_{({{- 2}F_{X}Y})}} \\ {v_{X^{3}}:v_{({3F_{Y}X^{2}})}} \\ {v_{X^{2}Y}:v_{({{{- F_{X}}X^{2}} + {2F_{Y}X\; Y}})}} \\ {v_{X\; Y^{2}}:v_{({{{- 2}F_{X}X\; Y} + {F_{Y}Y^{2}}})}} \\ {v_{X^{4}}:v_{({4F_{Y}X^{3}})}} \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 6} \right\rbrack \end{matrix}$

From now on, upon triangulating the matrix M_(D) with the row-reducing transformation, the type of the ideal J and its Groebner basis can be obtained similarly to the composition operation 1.

(Remark)

In the event that the condition (3) does not hold for the ideal I, the rank of the matrix M_(D) becomes equal to or less than 5. In calculating the Groebner basis of I², at first, assume that it meets the condition (3) for calculation, and as a result of the row-reducing transformation, if it becomes clear that the rank of the matrix M_(D) is equal to or less than 5, then elements R₁ and R₂ that yields R₁+R₂=0 should be generated to calculate (I+R₁)+(I+R₂) instead of I+I.

(Reduction Operation)

Now study a second step (and a third step) of the additive algorithm 1, which is hereinafter referred to as a reduction operation. That is, for the ideal J of which the order is equal to or less than 6, the Groebner basis of J*=f_(J):J is to be found. The case is mentioned below in which J is of type 61; however the other case is also similar.

J is of type 61, whereby its Groebner basis can be expressed by {f _(J) =X ³ +a ₆ Y ² + . . . , g=X ² Y+b ₆ Y ² + . . . , h=XY ² +c ₆ Y ²+ . . . } By definition, J*=f_(J):J, whereby δ(J*)=−v_(∞)(f_(J))−δ(J)=3. Thus, it can be seen that J* becomes an ideal of a type 31 because J* is a reduced ideal. Thus so as to find its Groebner basis, for the monomial m_(i) in 1, X, Y, X², XY, and Y²  (4) a linear relation Σ_(i)d_(i)m_(i) should be found in which Σ_(i)d_(i)m_(i)g and Σ_(i)d_(i)m_(i)h become zero simultaneously in R/f_(J).

From LM(F)=Y³,LM(f_(J))=X³, then

$\begin{matrix} {\left. {{{R/f_{J}}R} \cong {{k \cdot 1} \oplus {k \cdot X} \oplus {k \cdot Y} \oplus {k \cdot X^{2}} \oplus {{k \cdot X}\; Y} \oplus {k \cdot Y^{2}} \oplus {k \cdot f}}}\mspace{56mu}\mapsto w_{j} \right.\mspace{121mu}{{X^{2}Y} \oplus {{k \cdot X}\; Y^{2}} \oplus {{k \cdot X^{2}}\; Y^{2}}}} & \left\lbrack {{EQ}.\mspace{11mu} 7} \right\rbrack \end{matrix}$ whereby, so as to find the above-mentioned linear relation, for each of six monomials m_(i) in the equation (4), an intra-row linear relation should be found of the following 6×18 matrix M_(R) with a 18-dimensional vector w_((mi g)):w_((mi h)) over k to be obtained by connecting two vectors w_((mi g)) and w_((mi h)) taken as a row.

$\begin{matrix} {M_{R} = \begin{pmatrix} {w_{g}:w_{h}} \\ {w_{X\; g}:w_{X\; h}} \\ {w_{Y\; g}:w_{Y\; h}} \\ {w_{X^{2}g}:w_{X^{2}h}} \\ {w_{X\; Y_{g}}:w_{X\; Y\; h}} \\ {w_{Y^{2}g}:w_{Y^{2}h}} \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{11mu} 8} \right\rbrack \end{matrix}$

From now on, upon triangulating the matrix M_(R) with the row-reducing transformation, the Groebner basis of the ideal J* can be obtained. However, as matter of fact, in almost every case, it is enough to triangulate not the matrix M_(R) itself but a certain submatrix M_(r) of its 6×3. This will be described in details in the next chapter.

(Arithmetic Quantity of Algorithm)

An arithmetic quantity of the algorithm will be evaluated. Set the order of the defining field to q, then a random element of the Jacobian group is represented by the ideal of a type 31 apart from an exception of a probability of 1/q. Also, the result of the composition operations 1 and 2 for the ideal of a type 31 demonstrates that it becomes an ideal of a type 61 apart from an exception of a probability of 1/q. Thus, so as to evaluate the arithmetic quantity of the algorithm, the arithmetic quantity of the composition operations 1 and 2 at the time of having input the ideal of a type 31, and the arithmetic quantity of the reduction operation at the time of having input the ideal of a type 61 or a type 31 should be evaluated. Also, the arithmetic quantity of the algorithm is represented below with the number of the times of multiplication and reciprocal arithmetic.

At first, the arithmetic quantity of the composition operation 1 is examined. Suppose that I₁ and I₂ are ideals of type 31: then I ₁ ={X ² +a ₃ Y+a ₂ X+a ₁ ,XY+b ₃ Y+b ₂ X+b ₁ ,Y ² +c ₃ Y+c ₂ X+c ₁} I ₂ ={X ² +s ₃ Y+s ₂ X+s ₁ ,XY+t ₃ Y+t ₂ X+t ₁ ,Y ² +u ₃ Y+u ₂ X+u ₁} For the ideals I₁ and I₂, the matrix M_(c) is expressed by

$\begin{matrix} {M_{C} = \begin{pmatrix} 1 & 0 & 0 & 1 & 0 & 0 \\ 0 & 1 & 0 & 0 & 1 & 0 \\ 0 & 0 & 1 & 0 & 0 & 1 \\ {- a_{1}} & {- a_{2}} & {- a_{3}} & {- s_{1}} & {- s_{2}} & {- s_{3}} \\ {- b_{1}} & {- b_{2}} & {- b_{3}} & {- t_{1}} & {- t_{2}} & {- t_{3}} \\ {- c_{1}} & {- c_{2}} & {- c_{3}} & {- u_{1}} & {- u_{2}} & {- u_{3}} \\ {{a_{1}a_{2}} + {a_{3}b_{1}}} & {{- a_{1}} + a_{2}^{2} + {a_{3}b_{2}}} & {{a_{2}a_{3}} + {a_{3}b_{3}}} & {{s_{1}s_{2}} + {s_{3}t_{1}}} & {{- s_{1}} + s_{2}^{2} + {s_{3}t_{2}}} & {{s_{2}s_{3}} + {s_{3}t_{3}}} \\ {{a_{2}b_{1}} + {a_{3}c_{1}}} & {{a_{2}b_{2}} + {a_{3}c_{2}}} & {{- a_{1}} + {a_{2}b_{3}} + {a_{3}c_{3}}} & {{s_{2}t_{1}} + {s_{3}u_{1}}} & {{s_{2}t_{2}} + {s_{3}u_{2}}} & {{- s_{1}} + {s_{2}t_{3}} + {s_{3}u_{3}}} \\ {{b_{1}b_{2}} + {b_{3}c_{1}}} & {b_{2}^{2} + {b_{3}c_{2}}} & {{- b_{1}} + {b_{2}b_{3}} + {b_{3}c_{3}}} & {{t_{1}t_{2}} + {t_{3}u_{1}}} & {t_{2}^{2} + {t_{3}u_{2}}} & {{- t_{1}} + {t_{2}t_{3}} + {t_{3}u_{3}}} \\ e_{10,1} & e_{10,2} & e_{10,3} & e_{10,4} & e_{10,5} & e_{10,6} \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{11mu} 9} \right\rbrack \end{matrix}$ where, e _(10,1) =a ₁ ² −a ₁ a ₂ ²−2a ₂ a ₃ b ₁ −a ₃ ² c ₁ e _(10,2)=2a ₁ a ₂ −a ₂ ³−2a ₂ a ₃ b ₂ −a ₃ ² c ₂ e _(10,3)=2a ₁ a ₃ −a ₂ ² a ₃−2a ₂ a ₃ b ₃ −a ₃ ² c ₃ e _(10,4) =s ₁ ² −s ₁ s ₂ ²−2s ₂ s ₃ t ₁ −s ₃ ² u ₁ e _(10,5)=2s ₁ s ₂ −s ₂ ³−2s ₂ s ₃ t ₂ −s ₃ ² u ₂ e _(10,6)=2s ₁ s ₃ −s ₂ ² s ₃−2s ₂ s ₃ t ₃ −s ₃ ² u ₃ From this, it can be seen that upon eliminating multiplicity successfully, the matrix M_(c) can be constructed with at most 44-times multiplication.

Upon paying attention to the fact that the row-reduction transformation for the matrix M_(c)′ takes a formula having the first row to the third row thereof already row-reduction, and that its component is 0 or 1, it can be executed with three-times division and at most 6×6+6×5+6×4=90-times multiplication. From the foregoing, the arithmetic quantity of the composition operation 1 is at most three-times reciprocal arithmetic, and 134-times multiplication. Similarly, it can be seen that the arithmetic quantity of the composition operation 2 is at most three-times reciprocal arithmetic, and 214-times multiplication. The arithmetic quantity is increased by the extent to which the matrix M_(D) is more complex than M_(c).

Next, the arithmetic quantity of the reduction operation at the time of having input the ideal of a type 61 is examined. Suppose J is an ideal of type 61: then J={X ³ +a ₆ Y ² +a ₅ XY+a ₄ X ² +a ₃ Y+a ₂ X+a ₁ ,X ² Y+b ₆ Y ² +b ₅ XY+b ₄ X ² +b ₃ Y+b ₂ x+b ₁ ,XY ² +c ₆ Y ² +c ₅ XY+c ₄ X ² +c ₃ Y+c ₂ X+c ₁}

A 6×3 minor M_(r) obtained by taking a seventh column to a ninth column of the matrix M_(R) for the ideal J becomes

            [EQ.  10] $M_{r} = \left( \begin{matrix} 1 & 0 & 0 \\ {{- a_{4}} - {a_{5}a_{6}} + b_{5}} & {{- a_{5}} - a_{6}^{2} + b_{6}} & 0 \\ {b_{4} + {a_{5}b_{6}}} & {b_{5} + {a_{6}b_{6}}} & 1 \\ e_{4,1} & e_{4,2} & {{- a_{5}} - a_{6}^{2} + b_{6}} \\ e_{5,1} & e_{5,2} & {{- a_{4}} - {2a_{5}a_{6}} - a_{6}^{3} + b_{5} + {a_{6}b_{6}}} \\ e_{6,1} & e_{6,2} & e_{6,3} \end{matrix} \right)$ where

e_(4, 1) = −a₂ + a₄² − a₃a₆ + 3a₄a₅a₆ + a₅²a₆² + b₃ − a₅b₄ − a₄b₅ − a₅a₆b₅ e_(4, 2) = −a₃ + a₄a₅ + a₅²a₆ + 2a₄a₆² + a₅a₆³ − a₆b₄ − a₅b₅ − a₆²b₅ e_(5, 1) = −2a₃a₅ + 2a₄a₅² − a₂a₆ + a₄²a₆ + a₅³a₆ − a₃a₆² + 3a₄a₅a₆² + a₅²a₆³ + b₂ − a₄b₄ − a₅a₆b₄ + a₃b₆ − 2a₄a₅b₆ − a₅²a₆b₆ e_(5, 2) = −a₂ + a₅³ − 2a₃a₆ + 2a₄a₅a₆ + 2a₅²a₆² + 2a₄a₆³ + a₅a₆⁴ + b₃ − a₅b₄ − a₆²b₄ − a₅²b₆ − a₄a₆b₆ − a₅a₆²b₆ e_(6, 1) = −2a₃a₄ − 2a₂a₅ + 3a₄²a₅ − 4a₃a₅a₆6a₄a₅²a₆ − a₂a₆² + a₄²a₆² + 2a₅³a₆² − a₃a₆³ + 3a₄a₅a₆³ + a₅²a₆⁴ + a₅b₃ + a₃b₅ − 2a₄a₅b₅ − a₅²a₆b₅ + a₂b₆ − a₄²b₆ + a₃a₆b₆ − 3a₄a₅a₆b₆ − a₅²a₆²b₆ e_(6, 2) = −2a₃a₅ + 2a₄a₅² − 2a₂a₆ + a₄²a₆ + 2a₅³a₆ − 3a₃a₆² + 5a₄a₅a₆² + 3a₅²a₆³ + 2a₄a₆⁴ + a₅a₆⁵ + b₂ + a₆b₃ − a₅²b₅ − a₄a₆b₅ − a₅a₆²b₅ + a₃b₆ − a₄a₅b₆ − a₅²a₆b₆ − 2a₄a₆²b₆ − a₅a₆³b₆ e_(6, 3) = −a₅² − 2a₄a₆ − 3a₅a₆² − a₆⁴ + b₄ + a₆b₅ + a₅b₆ + a₆²b₆

This leads to the result that, if a (2,2) component d=−a₅−a₆ ²+b₆ of the matrix M_(r) is not zero, the rank of the matrix M_(r) becomes 3. Thus, when d≠0, instead of the 6×18 matrix M_(R) the 6×3 matrix M_(r) should be employed that is its minor. It is acceptable to let d≠0 in evaluating efficiency of the algorithm because the probability of d=0 is considered to be 1/q or something like it. From the above equation, it can be seen that upon eliminating multiplicity successfully, the matrix M_(r) can be constructed with at most 40-times multiplication. Upon paying attention to the fact that the matrix M_(r) is already a triangle matrix, and that (1,1) and (3,3) components thereof are 1, it can be seen that the row-reduction transformation for the matrix M_(r)′ can be executed with at most one-time reciprocal arithmetic and 2×4+2×3=14-times multiplication. From the foregoing, the arithmetic quantity of the reduction operation at the time of inputting the ideal of a type 61 is at most one-time reciprocal arithmetic and 54-times multiplication. Also at the time of inputting the ideal of a type 31, from the similar consideration, it can be seen that the reduction operation requires most one-time reciprocal arithmetic and 16-times multiplication.

Upon summarizing the foregoing, it follows that the arithmetic quantity of the additive algorithm on Jacobian group of the present invention is one as shown in FIG. 16. In FIG. 16, I and M represent the reciprocal arithmetic and the multiplication respectively. On the elliptic curve, the addition (of different elements) can be executed with one-time reciprocal arithmetic and three-times multiplication, and the arithmetic of two-times multiple can be executed with one-time reciprocal arithmetic and four-times multiplication. However, so as to obtain a group of the same bit length, the bit length of the finite field requires three times as large arithmetic quantity as the case of the C₃₄ curve does. Suppose that the arithmetic quantity of the reciprocal arithmetic is twenty times as large as that of the multiplication, and that the arithmetic quantity of the reciprocal arithmetic and the multiplication is on the order of a square of the bit length, then it can be seen that the addition on the C₃₄ curve can be executed with 304/(23×9)≈1.47 times as large arithmetic quantities as that on the elliptic cure can be done, and the arithmetic of two-times multiple 384/(24×9)≈1.78 times.

BRIEF DESCRIPTION OF THE DRAWING

This and other objects, features and advantages of the present invention will become more apparent upon a reading of the following detailed description and drawings, in which:

FIG. 1 is a block diagram illustrating an embodiment of the present invention;

FIG. 2 is a functional block diagram of an ideal composition section;

FIG. 3 is a functional block diagram of an ideal reduction section;

FIG. 4 is one specific example of an algebraic curve parameter file A for the C₃₄ curve;

FIG. 5 is one specific example of an ideal type table for the C₃₄ curve;

FIG. 6 is one specific example of a monomial list table for the C₃₄ curve;

FIG. 7 is one specific example of a table for a Groebner basis construction for the C₃₄ curve;

FIG. 8 is one specific example of the algebraic curve parameter file for the C₂₇ curve;

FIG. 9 is one specific example of the ideal type table for the C₂₇ curve;

FIG. 10 is one specific example of the monomial list table for the C₂₇ curve;

FIG. 11 is one specific example of the table for a Groebner basis construction for the C₂₇ curve;

FIG. 12 is one specific example of the algebraic curve parameter file for the C₂₅ curve;

FIG. 13 is one specific example of the ideal type table for the C₂₅ curve;

FIG. 14 is one specific example of the monomial list table for the C₂₅ curve;

FIG. 15 is one specific example of the table for a Groebner basis construction table for the C₂₅ curve; and

FIG. 16 is a table illustrating the arithmetic quantity of the additive algorithm on Jacobian group in accordance with the present invention.

DESCRIPTION OF THE EMBODIMENT

Embodiments of the present invention will be explained below in details by employing the accompanied drawings. FIG. 1 is a functional block diagram of the embodiment of the present invention, and the FIG. 2 is a block diagram illustrating an example of the ideal composition section of FIG. 1. FIG. 3 is a block diagram illustrating an example of a first and a second ideal reduction section of FIG. 1.

At first, the embodiment of the case in which the C₃₄ curve was employed is shown. In this embodiment, the algebraic curve parameter file of FIG. 4 is employed as an algebraic curve parameter file, the ideal type table of FIG. 5 as an ideal type table, the monomial list table of FIG. 6 as an monomial list table, and the table for a Groebner basis construction of FIG. 7 as a table for a Groebner basis construction respectively.

In a Jacobian group element adder of FIG. 1, suppose the Groebner bases I ₁ ={X ²+726Y+836X+355,XY+36Y+428X+477,Y ²+764Y+425X+865} and I ₂ ={X ²+838Y+784X+97,XY+602Y+450X+291,Y ²+506Y+542X+497} were input of the ideal of the coordinate ring of the algebraic curve designated by an algebraic curve parameter file A, which represents an element of the Jacobian group of the C₃₄ curve designated by an algebraic curve parameter file A 16 and an algebraic curve parameter file A of FIG. 4.

At first, an ideal composition section 11, which takes the above-mentioned algebraic curve parameter file A, and the above-mentioned Groebner bases I₁ and I₂ as an input, operates as follows according to a flow of a process of the functional block shown in FIG. 2. At first, the ideal composition section 11 makes a reference to an ideal type table 25 of FIG. 5 in an ideal type classification section 21 of FIG. 2, retrieves a record in which the ideal type described in an ideal type field accords with the type of the input ideal I₁ for obtaining a fourteenth record, and acquires a value N₁=31 of an ideal type number field and a value d₁=3 of an order field of the fourteenth record.

Similarly, the ideal composition section 11 retrieves a record in which the ideal type accords with the type of the input ideal I₂ for obtaining the fourteenth record, and acquires a value N₂=31 of the ideal type number field and a value d₂=3 of the order field of the fourteenth record.

Next, the ideal composition section 11 calculates the sum d₃=d₁+d₂=6 of said values d₁=3 and d₂=3 of said order field in a monomial vector generation section 22, makes a reference to a monomial list table 26, retrieves a record of which the value of the order field is said d₃=6 for obtaining a first record, and acquires a list 1, X, Y, X², XY, Y², X³, X²Y, XY², and X⁴ of the monomial described in the monomial list field of the first record.

I₁ and I₂ are different, whereby a remainder to be attained by dividing M_(i) by I₁ for each of M_(i)(1<=i<=10) in said list 1, X, Y, X², XY, Y², X³, X²Y, XY², and X⁴ of said monomial is calculated to obtained a polynomial a^((i)) ₁+a^((i)) ₂X+a^((i)) ₃Y, to arrange its coefficients in order of the monomial order 1, X, Y, . . . of the algebraic curve parameter file A, and to generate a vector (a^((i)) ₁,a^((i)) ₂, a^((i)) ₃). Furthermore, a remainder to be attained by dividing M_(i) by I₂ is calculated to obtain a polynomial b^((i)) ₁+b^((i)) ₂X+b^((i)) ₃Y, to arrange its coefficients in order of the monomial order 1, X, Y, . . . of the algebraic curve parameter file A, to generate a vector (b^((i)) ₁,b^((i)) ₂,b^((i)) ₃), and to connect the above-mentioned two vectors for generating a vector v_(i)=(a^((i)) ₁,a^((i)) ₂,a^((i)) ₃,b^((i)) ₁,b^((i)) ₂,b^((i)) ₃)

That is, divide M₁=1 by I₁: then I=0·(X²+726Y+836X+355)+0·(XY+36Y+428X+477)+0·(Y²+746Y+425X+865)+1 whereby, 1 is obtained as a remainder to generate a vector (1,0,0). Divide M₁=1 by I₂: then I=0·(X²+838Y+784X+97)+0·(XY+602Y+450X+291)+0·(Y²+506Y+524X+497)+1 whereby, 1 is obtained as a remainder to generate a vector (1,0,0). These two vectors are connected to generate a vector v₁=(1,0,0,1,0,0).

Next, divide M₂=X by I₁: then X=0·(X²+726Y+836X+355)+0·(XY+36Y+428X+477)+0·(Y²+746Y+425X+865)+X whereby, X is obtained as a remainder to generate a vector (0,1,0). Divide M₂=X by I₂: then 1=0·(X²+838Y+784X+97)+0·(XY+602Y+450X+291)+0·(Y²+506Y+524X+497)+X whereby, X is obtained as a remainder to generate a vector (0,1,0). These two vectors are connected to generate a vector v₂=(0,1,0,0,1,0).

Next, divide M₃=Y by I₁: then Y=0·(X²+726Y+836X+355)+0·(XY+36Y+428X+477)+0·(Y²+746Y+425X+865)+Y whereby, Y is obtained as a remainder to generate a vector (0,0,1). Divide M₃=Y by I₂: then Y=0·(X²+838Y+784X+97)+0·(XY+602Y+450X+291)+0·(Y²+506Y+524X+497)+Y whereby, Y is obtained as a remainder to generate a vector (0,0,1). These two vectors are connected to generate a vector v₃=(0,0,1,0,0,1).

Next, divide M₄=X₂ by I₁: then X²=1·(X₂+726Y+836X+355)+0·(XY+36Y+428X+477)+0·(Y²+746Y+425X+865)+654+173X+283Y whereby, 654+173X+283Y is obtained as a remainder to generate a vector (654,173,283). Divide M₄=X² by I₂: then X²=1·(X²+838Y+784X+97)+0·(XY+602Y+450X+291)+0·(Y²+506Y+524X+497)+912+225X+171Y, whereby, 912+225X+171Y is obtained as a remainder to generate a vector (912,225,171). These two vectors are connected to generate a vector v₄=(654,173,283,912,225,171).

Next, divide M₅=XY by I₁: then XY=0·(X²+726Y+836X+355)+1·(XY+36Y+428X+477)+0·(Y²+746Y+425X+865)+532+581X+973Y whereby, 532+581X+973Y is obtained as a remainder to generate a vector (532,581,973). Divide M₅=XY by I₂: then XY=0·(X²+838Y+784X+97)+1·(XY+602Y+450X+291)+0·(Y²+506Y+524X+497)+718+559X+407Y, whereby, 718+559X+407Y is obtained as a remainder to generate a vector (718,559,407). These two vectors are connected to generate a vector v₅=(532,581,973,718,559,407).

Next, divide M₆=Y² by I₁: then Y²=0·(X²+726Y+836X+355)+0·(XY+36Y+428X+477)+1·(Y²+746Y+425X+865)+144+584X+263Y, whereby, 144+584X+263Y is obtained as a remainder to generate a vector (144,584,263). Divide M₆=Y² by I₂: then Y²=0·(X²+838Y+784X+97)+0·(XY+602Y+450X+291)+1·(Y²+506Y+524X+497)+512+485X+503Y, whereby, 512+485X+503Y is obtained as a remainder to generate a vector (512,485,503). These two vectors are connected to generate a vector v₆=(144,584,263,512,485,503).

Next, divide M₇=X³ by I₁: then X³=(173+X)·(X²+726Y+836X+355)+283·(XY+36Y+428X+477)+0·(Y²+746Y+425X+865)+349+269X+429Y, whereby, 349+269X+429Y is obtained as a remainder to generate a vector (349,269,429). Divide M₇=X³ by I₂: then X³=(255+X)·(X²+838Y+784X+97)+171·(XY+602Y+450X+291)+0·(Y²+506Y+524X+497)+53+821X+109Y, whereby, 53+821X+109Y is obtained as a remainder to generate a vector (53,821,109). These two vectors are connected to generate a vector v₇=(349,269,429,53,821,109)

Next, divide M₈=X²Y by I₁: then X²Y=Y·(X²+726Y+836X+355)+173·(XY+36Y+428X+477)+283·(Y²+746Y+425X+865)+609+418X+243Y, whereby, 609+418X+243Y is obtained as a remainder to generate a vector (609,418,243). Divide M₈=X²Y by I₂: then X²Y=Y·(X²+838Y+784X+97)+225·(XY+602Y+450X+291)+171·(Y²+506Y+524X+497)+888+856X+916Y, whereby, 888+856X+916Y is obtained as a remainder to generate a vector (888,856,916). These two vectors are connected to generate a vector v₈=(609,418,243,888,856,916).

Next, divide M₉=XY² by I₁: then XY²=0·(X²+726Y+836X+355)+(581+Y)·(XY+36Y+428X+477)+973·(Y²+746Y+425X+865)+199+720X+418Y, whereby, 199+720X+418Y is obtained as a remainder to generate a vector (199,720,418). Divide M₉=XY by I₂: then XY²=0·(X²+838Y+784X+97)+(559+Y)·(XY+602Y+450X+291)+407·(Y²+506Y+524X+497)+310+331X+91Y, whereby, 310+331X+91Y is obtained as a remainder to generate a vector (310,331,91). These two vectors are connected to generate a vector v₉=(199,720,418,310,331,91).

Next, divide M₁₀=X⁴ by I₁: then X⁴=(313+173X+X²⁺²⁸³Y)·(X²+726Y+836X+355)+45·(XY+36Y+428X+477)+378·(Y²+746Y+425X+865)+554+498X+143Y whereby, 554+498X+143Y is obtained as a remainder to generate a vector (554,498,143). Divide M₁₀=X⁴ by I₂: then X⁴=(78+225X+X²⁺¹⁷¹Y)·(X²+838Y+784X+97)+266·(XY+602Y+450X+291)+989·(Y²+506Y+524X+497)+643+522X+107Y, whereby, 643+522X+107Y is obtained as a remainder to generate a vector (643,522,107). These two vectors are connected to generate a vector v₁₀=(554,498,143,643,522,107). Above, the process of the ideal composition section 11 in the monomial vector generation section 22 is finished.

Next, in a basis construction section 23, the ideal composition section 11 inputs ten six-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, v₇, v₈, v₉, and v₁₀ generated in the monomial vector generation section 22 into a linear-relation derivation section 24, and obtains a plurality of 10-dimensional vectors m₁, m₂, . . . as an output. The linear-relation derivation section 24 derives a linear relation of the vectors, which were input, employing a discharging method. The discharging method is a well-known art, whereby, as to an operation of the linear-relation derivation section 24, only its outline is shown below.

The linear-relation derivation section 24 firstly arranges the ten six-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, v₇, v₈, v₉, and v₁₀, which were input, in order for constructing a 10×6 matrix

$\begin{matrix} {M_{c} = \begin{pmatrix} 1 & 0 & 0 & 1 & 0 & 0 \\ 0 & 1 & 0 & 0 & 1 & 0 \\ 0 & 0 & 1 & 0 & 0 & 1 \\ 654 & 173 & 283 & 912 & 225 & 171 \\ 532 & 581 & 973 & 718 & 559 & 407 \\ 144 & 584 & 263 & 512 & 485 & 503 \\ 349 & 269 & 429 & 53 & 821 & 109 \\ 609 & 418 & 243 & 888 & 856 & 916 \\ 199 & 720 & 418 & 310 & 331 & 91 \\ 554 & 498 & 143 & 643 & 522 & 107 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 11} \right\rbrack \end{matrix}$

Next, the linear-relation derivation section 24 connects a 10-dimensional unity matrix to a matrix M_(c) to obtain

$\begin{matrix} {\mspace{664mu}{\left\lbrack {{EQ}.\mspace{14mu} 12} \right\rbrack{M_{c} = \begin{pmatrix} 1 & 0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 1 & 0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 654 & 173 & 283 & 912 & 225 & 171 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\ 532 & 581 & 973 & 718 & 559 & 407 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\ 144 & 584 & 263 & 512 & 485 & 503 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\ 349 & 269 & 429 & 53 & 821 & 109 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\ 609 & 418 & 243 & 888 & 856 & 916 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 \\ 199 & 720 & 418 & 310 & 331 & 91 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\ 554 & 498 & 143 & 643 & 522 & 107 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 \end{pmatrix}}}} & \; \end{matrix}$

Next, the linear-relation derivation section 24 triangulates a matrix M′_(c) by adding a constant multiple of an i-th row to an (i+1)-th (i=1,2, . . . 6) row to a tenth row to obtain the following matrix m

            [EQ.  13] $m = \left( \begin{matrix} 1 & 0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 1 & 0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 258 & 52 & 897 & 355 & 836 & 726 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 621 & 688 & 268 & 365 & 592 & 187 & 1 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 31 & 514 & 469 & 637 & 669 & 155 & 1 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 28 & 132 & 31 & 271 & 469 & 166 & 1 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 856 & 618 & 747 & 909 & 132 & 636 & 0 & 1 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 652 & 322 & 240 & 978 & 826 & 846 & 0 & 0 & 1 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 333 & 346 & 980 & 935 & 824 & 614 & 0 & 0 & 0 & 1 \end{matrix} \right)$

As well known, the vector that is composed of a seventh component and afterward of the seventh row to the tenth row of the matrix m is a vector {m_(1,1),m_(1,2), . . . ,m_(1,n)), (m_(2,1),m_(2,2), . . . ,m_(2,n)) . . . } representing a linearly-independent linear dependence relation Σ_(i) ¹⁰m_(ji)v_(i)=0(j=1, 2, . . . ) of all of the ten six-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, v₇, v₈, v₉, and v₁₀ that were input. The linear-relation derivation section 24 outputs a vector m₁=(28,132,31,271,469,166,1,0,0,0) that is composed of the seventh component and afterward of the seventh row of the matrix m, a vector m₂=(856,618,747,909,132,636,0,1,0,0) that is composed of the seventh component and afterward of the eighth row of the matrix m, and a vector m₃=(652,322,240,978,826,846,0,0,1,0) that is composed of the seventh component and afterward of the ninth row of the matrix m, and a vector m₄=(333,346,980,935,824,614,0,0,0,1) that is composed of the seventh component and afterward of the tenth row of the matrix m. Now return to the explanation of the process of the ideal composition section 11 in the basis construction section 23.

Next, the ideal composition section 11 makes a reference to a table 27 for a Groebner basis construction of FIG. 7, and retrieves a record, of which the value of the order field is said value d₃=6, and in which a vector of which the components that correspond to all component numbers described in the component number list field are all zero does not lie in said plurality of said vectors m₁=(28,132,31,271,469,166,1,0,0,0), m₂=(856,618,747,909,132,636,0,1,0,0), m₃=(652,322,240,978,826,846,0,0,1,0), and m₄=(333,346,980,935,824,614,0,0,0,1). The value of the order field of a first record is 6, and a vector, of which the component number lists 7, 8, 9, and 10 of the first record are all zero, does not lie in the vectors m₁, m₂, m₃, and m₄, whereby the first record is obtained as a retrieval result

Furthermore, the value of a first vector type of the first record is (*,*,*,*,*,*,1,0,0,0)(A code * is interpreted as representing any number), which coincides with the vector m₁=(28,132,31,271,469,166,1,0,0,0), whereby the vector m₁ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, Y, X², XY, Y², X³, X²Y, XY², and X⁴ of the algebraic curve parameter file A to generate a polynomial f₁=28+132X+31Y+271X²+469XY+166Y²+X³

Similarly, the value of a second vector type of the first record is (*,*,*,*,*,*,0,1,0,0)(A code * is interpreted as representing any number), which coincides with the vector m₂=(856,618,747,909,132,636,0,1,0,0), whereby the vector m₂ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, Y, X², XY, Y², X³, X²Y, XY², and X⁴ of the algebraic curve parameter file A to generate a polynomial f₂=856+618X+747Y+909X²+132XY+636Y²+X²Y.

Similarly, the value of a third vector type of the first record is (*,*,*,*,*,*,0,0,1,0)(A code * is interpreted as representing any number), which coincides with the vector m₃=(652,322,240,978,826,846,0,0,1,0), whereby the vector m₃ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, Y, X², XY, Y², X³, X²Y, XY², and X⁴ of the algebraic curve parameter file A to generate a polynomial f₃=652+322X+240Y+978X²+826XY+846Y²+XY². Finally, the ideal composition section 11 constructs a set J={f₁,f₂,f₃} of the polynomial to output it. Above, the operation of the ideal composition section 11 is finished.

Next, the first ideal reduction section 12, which takes as an input the algebraic curve parameter file A of FIG. 4, and the Groebner basis J={28+132X+31Y+271X²+469XY+166Y²+X³, 856+618X+747Y+909X²+132XY+636Y²+X²Y, 652+322X+240Y+978X²+826XY+846Y²+XY²}that the ideal composition section 11 output, operates as follows according to a flow of the process of the functional block shown in FIG. 3.

At first, the ideal reduction section 12 makes a reference to an ideal type table 35 of FIG. 5 in an ideal type classification section 31 of FIG. 3, retrieves a record in which the ideal type described in the ideal type field accords with the type of the input ideal J for obtaining a first record, and acquires a value N=61 of the ideal type number field and a value d=3 of the reduction order field of the first record. Next, the ideal reduction section 12 confirms that said value d=3 is not zero, makes a reference to a monomial list table 36 in a polynomial vector generation section 32, retrieves a record of which the value of the order field is said d=3 for obtaining a fourth record, and acquires a list 1, X, Y, X², XY, Y², and X³ of the monomial described in the monomial list field of the fourth record.

Furthermore, the ideal reduction section 12 acquires a first element f=28+132X+31Y+271X²+469XY+166Y²+X³, a second element g=856+618X+747Y+909X²+132XY+636Y²+X²Y, and a third element h=652+322X+240Y+978X²+826XY+846Y²+XY² of J in the polynomial vector generation section 32, regards a coefficient list 0, 7, 0, 0, 0, 0, 0, 0, 0, 1, and 1 of the algebraic curve parameter file A as a column of the coefficient of each monomial of the monomial order 1, X, Y, X², XY, Y², X³, X²Y, XY², X⁴, and Y³ of the algebraic curve parameter file A, and generates a defining polynomial F=Y³+X⁴+7X.

Next, for each M_(i)(1<=i<=7) in said list 1, X, Y, X², XY, Y², and X³ of said monomial, the ideal reduction section 12 calculates a remainder equation r_(i) of a product M_(i)·g of M_(i) and the polynomial g by the polynomials f and F in the polynomial vector generation section 32, arranges its coefficients in order of the monomial order 1, X, Y, . . . of the algebraic curve parameter file A, and generates a vector w^((i)) ₁. Furthermore, the ideal reduction section 12 calculates a remainder equation si of a product M_(i)·h of M and the polynomial h by the polynomials f and F, arranges its coefficient in order of the monomial order 1, X, Y, . . . of the algebraic curve parameter file A, and generates a vector w^((i)) ₂, and connects the above-mentioned two vectors w^((i)) ₁ and w^((i)) ₂ for generating a vector v_(i).

That is, at first, for a first monomial M₁=1, divide 1·g=856+618X+747Y+909X²+132XY+636Y²+X²Y by f=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: then g=0·f+0·F+856+618X+747Y+909X²+132XY+636Y²+X²Y, whereby a remainder 856+618X+747Y+909X²+132XY+636Y²+X²Y is obtained to generate a vector w^((i))=(856,618,747,909,132,636,1,0,0).

Also, divide 1·h=652+322X+240Y+978X²+826XY+846Y²+XY² by f=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: then h=0·f+0·F+652+322X+240Y+978X²+826XY+846Y²+XY², whereby a remainder 652+322X+240Y+978X²+826XY+846Y²+XY² is obtained to generate a vector w^((i)) ₂=(652,322,240,978,826,846,0,1,0). And, the vectors w⁽¹⁾ ₁ and w⁽¹⁾ ₂ are connected to obtain a vector v₁=(856,618,747,909,132,636,1,0,0,652,322,240,978,826,846, 0,1,0).

Next, for a second monomial M₂=X, divide Xg=X(856+618X+747Y+909X²+132XY+636Y²+X²Y) by f=28+132X+31Y+271X²+469XY+166Y²+X and F=Y³+X⁴+7X: then Xg=(319+166Y+Y)f+843F+149+667X+220X²+173Y+235XY+709X²Y+492Y²+863XY², whereby a remainder 149+667X+220X²+173Y+235XY+709X²Y+492Y²+863XY² is obtained to generate a vector w⁽²⁾ ₁=(149,667,173,220,235,492,709,863,0).

Also, divide Xh=X(652+322X+240Y+978X²+826XY+846Y²+XY²) by f=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: Xh=978f+0·F+868+708X+651X²+961Y+653XY+826X²Y+101Y²⁺⁸⁴⁶XY²+X²Y², whereby a remainder 868+708X+651X²+961Y+653XY+826X²Y+101Y²⁺⁸⁴⁶XY²+X²Y² is obtained to generate a vector w⁽²⁾ ₂=(868,708,961,651,653,101,826,846,1). And, the vectors w⁽²⁾ ₁ and w⁽²⁾ ₂ are connected to obtain a vector v₂=(149,667,173,220,235,492,709,863,0,868,708,961,651,653, 101,826,846,1).

Next, for a third monomial M₃=Y, divide Yg=Y(856+618X+747Y+909X²+132XY+636Y²+X²Y) by f=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: Yg=(826+373X) f+636F+79+179X+357X²+475Y+216XY+529X²Y+855Y²+772XY²+X²Y², whereby a remainder 79+179X+357X²+475Y+216XY+529X²Y+855Y²+772XY²+X²Y² is obtained to generate a vector w⁽³⁾ ₁=(79,179,475,357,216,855,529,772,1).

Also, divide Yh=Y(652+322X+240Y+978X²+826XY+846Y²+XY²) by f=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: then Yh=(327+595X+1008X²+469Y)f+(685+X)F+934+966X+358X²+590Y+694XY+473X²Y+31Y²+939XY²+166X²Y² whereby a remainder 934+966X+358X²+590Y+694XY+473X²Y+31Y²+939XY²+166X²Y² is obtained to generate a vector w⁽³⁾ ₂=(934,966,590,358,694,31,473,939,166). And, the vectors w⁽³⁾ ₁ and w⁽³⁾ ₂ are connected to obtain a vector v₃=(79,179,475,357,216,855,529,772,1,934,966,590,358,694,3 1,473,939,166).

Next, for a fourth monomial M₄=X², divide X²g=X²(856+618X+747Y+909X²+132XY+636Y²+X²Y) by f=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: then X²g=(645+969X+166X²+709Y+XY)f+(359+843X)F+102+241X+394X²513Y+647XY+683X²Y+103Y²+1004XY²+863X²Y², whereby a remainder 102+241X+394X²+513Y+647XY+683X²Y+103Y²+1004XY²+863X²Y² is obtained to generate a vector w⁽⁴⁾ ₁=(102,241,513,394,647,103,683,1004,863).

Also, divide X²h=X²(652+322X+240Y+978X²+826XY+846Y²+XY²) by f=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: then X²h=(725+16X+782X²+754Y+166XY+Y²)f+(930+227X+843Y)F+889+260X+560X²+809Y+425XY+552X²Y+535Y²+671XY²+763X²Y², whereby a remainder 889+260X+560X²+809Y+425XY+552X²Y+535Y²+671XY²+763X²Y² is obtained to generate a vector w⁽⁴⁾ ₂=(889,260,809,560,425,535,552,671,763). And, the vectors w⁽⁴⁾ ₁ and w⁽⁴⁾ ₂ are connected to obtain a vector v₄=(102,241,513,394,647,103,683,1004,863,889,260,809,560,425,535,552,671,763).

Next, for a fifth monomial M₅=XY, divide XYg=XY(856+618X+747Y+909X²+132XY+636Y²+X²Y) by f=28+132X+31Y+271X²+469XY+166Y²+X and F=Y³+X⁴+7X: then XYg=(95+3X+146X²+457Y+166XY+Y²)f+(791+863X+843Y)F+367+X+54X²+403Y+361XY+276X²Y+305Y²+600XY²+689X²Y², whereby a remainder 367+X+54X²+403Y+361XY+276X²Y+305Y²+600XY²+689X²Y² is obtained to generate a vector w⁽⁵⁾ ₁=(367,1,403,54,361,305,276,600,689).

Also, divide XYh=XY(652+322X+240Y+978X²+826XY+846Y²+XY²) by f=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: then XYh=(804+648X+246X²+1008X³+629Y+782XY+166Y²)f+(421+25X+X²+696Y)F+695+924X+28 9X²+851Y+210XY+321X²Y+802Y²+522XY²+278X²Y², whereby a remainder 695+924X+289X²+851Y+210XY+321X²Y+802Y²+522XY²+278X²Y² is obtained to generate a vector w⁽⁵⁾ ₂=(695,924,851,289,210,802,321,522,278). And, the vectors w⁽⁵⁾ ₁ and w⁽⁵⁾ ₂ are connected to obtain a vector v₅=(367,1,403,54,361,305,276,600,689,695,924,851,289,210, 802,321,522,278).

Next, for a sixth monomial M₆=Y², divide Y²g=Y²(856+618X+747Y+909X²+132XY+636Y²+X²Y) by f=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: then Y²g=(687+214X+320X²+1008X³+77Y+146XY+166Y²)f+(981+960X+X²+323Y)F+944+384X+956X²+763Y+737XY+925X²Y+859Y²+416XY²+814X²Y², whereby a remainder 944+384X+956X²+763Y+737XY+925X²Y+859Y²+416XY²+814X²Y² is obtained to generate a vector w⁽⁶⁾ ₁=(944,384,763,956,737,859,925,416,814).

Also, divide Y²h=Y²(652+322X+240Y+978X²+826XY+846Y²+XY²) by f=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: then Y²h=(260+17X+731X²+843X³+382Y+246XY+1008X²Y+782Y²)f(369+868X+166X²+186Y+XY)F+792+963X+643X²+415Y+539XY+887X²Y+438Y²+102XY²+363X²Y², whereby a remainder 792+963X+643X²+415Y+539XY+887X²Y+438Y²+102XY²+363X²Y² is obtained to generate a vector w⁽⁶⁾ ₂=(792,963,415,643,539,438,887,102,363). And, the vectors w⁽⁶⁾ ₁ and w⁽⁶⁾ ₂ are connected to obtain a vector v₆=(944,384,763,956,737,859,925,416,814,792,963,415,643, 539,438,887,102,363).

Finally, for a seventh monomial M₇=X³, divide X³g=X³(856+618X+747Y+909X²+132XY+636Y²+X²Y) by f=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: then X³g=(323+583X+814X²+166X³+96Y+689XY+X²Y+863Y²)f+(698+514X+843X²+20Y) F+37+730X+831X²+416Y+136XY+55X²Y+971Y²+398XY²+5X²Y², whereby a remainder 37+730X+831X²+416Y+136XY+55X²Y+971Y²+398XY²+5X²Y² is obtained to generate a vector w⁽⁷⁾ ₁=(37,730,416,831,136,971,55,398,5).

Also, divide X³h=X³(652+322X+240Y+978X²+826XY+846Y²+XY²) by f=28+132X+31Y+271X²+469XY+166Y²+X³ and F=Y³+X⁴+7X: then X³h=(449+750X+363X²+782X³+102Y+278XY+166X²Y+763Y²+XY²)f+(784+583X+227X²+476Y+843XY)F+545+9X+173X²+378Y+902XY+16X²Y+831Y²+820XY²+909X²Y², whereby a remainder 545+9X+173X²+378Y+902XY+16X²Y+831Y²+820XY²+909X²Y² is obtained to generate a vector w⁽⁷⁾ ₂=(545,9,378,173,902,831,16,820,909). And, the vectors w⁽⁷⁾ ₁ and w⁽⁷⁾ ₂ are connected to obtain a vector v₇=(37,730,416,831,136,971,55,398,5,545,9,378,173,902,831, 16,820,909). Above, the process of the first ideal reduction section 12 in the polynomial vector generation section 32 is finished.

Next, in a basis construction section 33, the first ideal reduction section 12 inputs seven 18-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇, generated in the polynomial vector generation section 32 into a linear-relation derivation section 34, and obtains a plurality of seven-dimensional vectors m₁, m₂, . . . as an output. The linear-relation derivation section 34 derives a linear relation of the vectors, which were input, employing a discharging method. The discharging method belongs to a known art, whereby as to an operation of the linear-relation derivation section 34, only its outline is shown below.

The linear-relation derivation section 34 firstly arranges the seven 18-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇, which were input, in order for constructing a 7×18 matrix

$\begin{matrix} {M_{R} = \begin{pmatrix} 856 & 618 & 747 & 909 & 132 & 636 & 1 & 0 & 0 & 652 & 322 & 240 & 978 & 826 & 846 & 0 & 1 & 0 \\ 149 & 667 & 173 & 220 & 235 & 492 & 709 & 863 & 0 & 868 & 708 & 961 & 651 & 653 & 101 & 826 & 846 & 1 \\ 79 & 179 & 475 & 357 & 216 & 855 & 529 & 772 & 1 & 934 & 966 & 590 & 358 & 694 & 31 & 473 & 939 & 166 \\ 102 & 241 & 513 & 394 & 647 & 103 & 683 & 1004 & 863 & 889 & 260 & 809 & 560 & 425 & 535 & 552 & 671 & 763 \\ 367 & 1 & 403 & 54 & 361 & 305 & 276 & 600 & 689 & 695 & 924 & 851 & 289 & 210 & 802 & 321 & 522 & 278 \\ 944 & 384 & 763 & 956 & 737 & 859 & 925 & 416 & 814 & 792 & 963 & 415 & 643 & 539 & 438 & 887 & 102 & 363 \\ 37 & 730 & 416 & 831 & 136 & 971 & 55 & 398 & 5 & 545 & 9 & 378 & 173 & 902 & 831 & 16 & 820 & 909 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 14} \right\rbrack \end{matrix}$

Next, the linear-relation derivation section 34 connects a seventh-dimensional unity matrix to the matrix M_(R) to construct

$\begin{matrix} {M_{R}^{\prime} = \begin{pmatrix} 856 & 618 & 747 & 909 & 132 & 636 & 1 & 0 & 0 & 652 & 322 & 240 & 978 & 826 & 846 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\ 149 & 667 & 173 & 220 & 235 & 492 & 709 & 863 & 0 & 868 & 708 & 961 & 651 & 653 & 101 & 826 & 846 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\ 79 & 179 & 475 & 357 & 216 & 855 & 529 & 772 & 1 & 934 & 966 & 590 & 358 & 694 & 31 & 473 & 939 & 166 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\ 102 & 241 & 513 & 394 & 647 & 103 & 683 & 1004 & 863 & 889 & 260 & 809 & 560 & 425 & 535 & 552 & 671 & 763 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\ 367 & 1 & 403 & 54 & 361 & 305 & 276 & 600 & 689 & 695 & 924 & 851 & 289 & 210 & 802 & 321 & 522 & 278 & 0 & 0 & 0 & 0 & 1 & 0 & 0 \\ 944 & 384 & 763 & 956 & 737 & 859 & 925 & 416 & 814 & 792 & 963 & 415 & 643 & 539 & 438 & 887 & 102 & 363 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\ 37 & 730 & 416 & 831 & 136 & 971 & 55 & 398 & 5 & 545 & 9 & 378 & 173 & 902 & 831 & 16 & 820 & 909 & 0 & 0 & 0 & 0 & 0 & 0 & 1 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 15} \right\rbrack \end{matrix}$

Next, the linear-relation derivation section 34 triangulates a matrix M′_(R) by adding a constant multiple of an i-th row to an (i+1)-th row (i=1,2,and 3) to a seventh row to obtain the following matrix m.

$\begin{matrix} {m = \begin{pmatrix} 856 & 618 & 747 & 909 & 132 & 636 & 1 & 0 & 0 & 652 & 322 & 240 & 978 & 826 & 846 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 62 & 485 & 393 & 47 & 320 & 677 & 863 & 0 & 184 & 494 & 344 & 634 & 455 & 272 & 826 & 814 & 1 & 977 & 1 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 252 & 630 & 861 & 845 & 645 & 389 & 1 & 380 & 422 & 1006 & 632 & 736 & 748 & 221 & 979 & 217 & 281 & 51 & 1 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 982 & 226 & 146 & 1 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 449 & 79 & 320 & 0 & 1 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 544 & 564 & 195 & 0 & 0 & 1 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 79 & 930 & 1004 & 0 & 0 & 0 & 1 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 16} \right\rbrack \end{matrix}$

As well known, the vector that is composed of a nineteenth component and afterward of a fourth row to a seventh row of the matrix m is a vector {(m_(1,1),m_(1,2), . . . ,m_(1,7)), (m_(2,1),m_(2,2), . . . ,m_(2,7)), . . . } representing a linearly-independent linear dependence relation Σ_(i) ⁷m_(ji)v_(i)=0(j=1,2 . . . ) of all of the seven 18-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇ that were input. The linear-relation derivation section 34 outputs a vector m₁=(982,226,146,1,0,0,0) that is composed of the nineteenth component and afterward of the fourth row of the matrix m, a vector m₂=(449,79,320,0,1,0,0) that is composed of the nineteenth component and afterward of the fifth row of the matrix m, and a vector m₃=(544,564,195,0,0,1,0) that is composed of the nineteenth component and afterward of the sixth row of the matrix m, and a vector m₄=(79,930,1004,0,0,0,1) that is composed of the nineteenth component and afterward of the seventh row of the matrix m.

Now return to the explanation of the process of the first ideal reduction section 12 in the basis construction section 33. Next, this ideal reduction section 12 makes a reference to a table 37 for a Groebner basis construction of FIG. 7, and retrieves a record, of which the value of the order field is said value d=3, and in which a vector of which the components that correspond to all component numbers described in the component number list field are all zero does not lie in said plurality of said vectors m₁=(982,226,146,1,0,0,0), m₂=(449,79,320,0,1,0,0), m₃=(544,564,195,0,0,1,0), and m₄=(79,930,1004,0,0,0,1). The value of the order field of a fourteenth record is 3, and a vector, of which the components that correspond to the component number lists 4, 5, 6, and 7 of the fourteenth record are all zero, does not lie in the vectors m₁, m₂, m₃, and m₄, whereby the fourteenth record is obtained as a retrieval result.

Furthermore, the value of the first vector type of the fourteenth record is (*,*,*,1,0,0,0)(A code * is interpreted as representing any number), which coincides with the vector m₁=(982,226,146,1,0,0,0), whereby the vector m₁ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, Y, X², XY, Y², and X³ of the algebraic curve parameter file A to generate a polynomial f₁=982+226X+146Y+X².

Similarly, the value of the second vector type of the fourteenth record is (*,*,*,0,1,0,0) (A code * is interpreted as representing any number), which coincides with the vector m₂=(449,79,320,0,1,0,0), whereby the vector m₂ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, Y, X², XY, Y², and X³ of the algebraic curve parameter file A to generate a polynomial f₂=449+79X+320Y+XY.

Similarly, the value of the third vector type of the fourteen record is (*,*,*,0,0,1,0)(A code * is interpreted as representing any number), which coincides with the vector m₃=(544,564,195,0,0,1,0), whereby the vector m₃ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, Y, X², XY, Y², and X³ of the algebraic curve parameter file A to generate a polynomial f₃=544+564X+195Y+Y².

Finally, the ideal reduction section 12 constructs a set J*={f₁=982+226X+146Y+X²,f₂=449+79X+320Y+XY, f₃=544+564X+195Y+Y²} of the polynomial to output it. Above, the operation of the first ideal reduction section 12 is finished.

Next, a second ideal reduction section 13, which takes as an input the algebraic curve parameter file A 30 of FIG. 4, and the Groebner basis J*={982+226X+146Y+X²,449+79X+320Y+XY,544+564X+195Y²} that the first ideal reduction section 12 output, operates as follows according to a flow of the process of the functional block shown in FIG. 3. At first, in the ideal type classification section 31 of FIG. 3, the second ideal reduction section 13 makes a reference to the ideal type table 35 of FIG. 5, retrieves a record in which the ideal type described in the ideal type field accords with the type of the input ideal J* for obtaining a fourteenth record, and acquires a value N=31 of the ideal type number field and a value d=3 of the reduction order field of the fourteenth record.

Next, the ideal reduction section 13 confirms that said value d=3 is not zero, makes a reference to the monomial list table 36 in the polynomial vector generation section 32, retrieves a record of which the value of the order field is said d=3 for obtaining a fourth record, and acquires a list 1, X, Y, X², XY, Y², and X³ of the monomial described in the monomial list field of the fourth record.

Furthermore, the ideal reduction section 13 acquires a first element f=982+226X+146Y+X², a second element g=449+79X+320Y+XY, and a third element h=544+564X+195Y+Y² of J*, regards a coefficient list 0,7,0,0,0,0,0,0,0,1,1 of the algebraic curve parameter file A as a column of the coefficient of each monomial of the monomial order 1, X, Y, X², XY, Y², X³, X²Y, XY², X⁴, and Y³ of the algebraic curve parameter file A, and generates a defining polynomial F=Y³+X⁴+7X.

Next, for each of M_(i)(1<=i<=7) in said list 1, X, Y, X², XY, Y², and X³ of said monomial, the ideal reduction section 13 calculates a remainder equation r_(i) of a product M_(i)·g of M_(i) and the polynomial g by the polynomials f and F, arranges its coefficients in order of the monomial order 1, X, Y, . . . of the algebraic curve parameter file A, and generates a vector w^((i)) ₁. Furthermore, the ideal reduction section 13 calculates a remainder equation s_(i) of a product M_(i)·h of M_(i) and the polynomial h by the polynomials f and F, arranges its coefficients in order of the monomial order 1, X, Y, . . . of the algebraic curve parameter file A, and generates a vector w^((i)) ₂, and connects the above-mentioned two vectors w^((i)) ₁ and w^((i)) ₂ for generating a vector v_(i).

That is, at first, for a first monomial M₁=1, divide 1·g=449+79X+320Y+XY by f=982+226X+146Y+X² and F=Y³+X⁴+7X, :then g=0·f+0·F+449+79X+320Y+XY, whereby a remainder 449+79X+320Y+XY is obtained to generate a vector w⁽¹⁾ ₁=(449,79,320,1,0,0). Also, divide 1·h=544+564X+195Y+Y² by f=982+226X+146Y+X² and F=Y³+X⁴+7X: then h=0·f+0·F+544+564X+195Y+Y², whereby a remainder 544+564X+195Y+Y² is obtained to generate a vector w⁽¹⁾ ₂=(544,564,195,0,1,0). And, the vectors w⁽¹⁾ ₁ and w⁽¹⁾ ₂ are connected to obtain a vector v₁=(449,79,320,1,0,0,544,564,195,0,1,0).

Next, for a second monomial M₂=X, divide Xg=X(449+79X+320Y+XY) by f=982+226X+146Y+X² and F=Y³+X⁴+7X: then Xg=(79+Y)f+0·F+115+757X+601Y+94XY+863Y², whereby a remainder 115+757X+601Y+94XY+863Y² is obtained to generate a vector w⁽²⁾ ₁=(115,757,601,94,863,0).

Also, divide Xh=X(544+564X+195Y+Y²) by f=982+226X+146Y+X² and F=Y³+X⁴+7X: then Xh=564f+0·F+93+214X+394Y+195XY+XY , whereby a remainder 93+214X+394Y+195XY+XY² is obtained to generate a vector w⁽²⁾ ₂=(93,214,394,195,0,1). And, the vectors w⁽²⁾ ₁ and w⁽²⁾ ₂ are connected to obtain a vector v₂=(115,757,601,94,863,0,93,214,394,195,0,1).

Next, for a third monomial M₃=Y, divide Yg=Y(449+79X+320Y+XY) by f=982+226X+146Y+X² and F=Y³+X⁴+7X: then Yg=0·f+0·F+449Y+79XY+320Y²+XY², whereby a remainder 449Y+79XY+320Y²+XY² is obtained to generate a vector w⁽³⁾ ₁=(0,0,449,79,320,1).

Also, divide Yh=Y(544+564X+195Y+Y²) by f=982+226X+146Y+X² and F=Y³+X⁴+7X: then Yh=(356+226X+1008X²+146Y)f+1·F+531+305X+942Y+157XY+68Y², whereby a remainder 531+305X+942Y+157XY+68Y² is obtained to generate a vector w⁽³⁾ ₂=(531,305,942,157,68,0). And, the vectors w⁽³⁾ ₁ and w⁽³⁾ ₂ are connected to obtain a vector v₃=(0,0,449,79,320,1,531,305,942,157,68,0).

Next, for a fourth monomial M₄=X², divide X²g=X²(449+79X+320Y+XY) by f=982+226X+146Y+X² and F=Y³+X⁴+7X: then X²g=(757+79X+94Y+XY)f+0·F+259+563X+988Y+546XY+402Y²+863XY², whereby a remainder 259+563X+988Y+546XY+402Y²+863XY² is obtained to generate a vector w⁽⁴⁾ ₁=(259,563,988,546,402,863).

Also, divide X²h=X² (544+564X+195Y+Y²) by f=982+226X+146Y+X² and F=Y³+X⁴+7X: then X²h=(706+865X+146X²+68Y+Y²)f+863F+900+27X+669Y+611XY+189Y²+783XY², whereby a remainder 900+27X+669Y+611XY+189Y²+783XY² is obtained to generate a vector w⁽⁴⁾ ₂=(900,27,669,611,189,783). And, the vectors w⁽⁴⁾ ₁ and w⁽⁴⁾ ₂ are connected to obtain a vector v₄=(259,563,988,546,402,863,900,27,669,611,189,783).

Next, for a fifth monomial M₅=XY, divide XYg=XY(449+79X+320Y+XY) by f=982+226X+146Y+X² and F=Y³+X⁴+7X: then XYg=(492+301X+146X²+961Y+Y²) f+863F+167+875X+529Y+648XY+981Y²+94XY² whereby a remainder 167+875X+529Y+648XY+981Y²+94XY² is obtained to generate a vector w⁽⁵⁾ ₁=(167,875,529,648,981,94). Also, divide XYh=XY(544+564X+195Y+Y²) by f=982+226X+146Y+X² and F=Y³+X⁴+7X: then XYh=(305+356X+226X²+1008X³+157Y+146XY)f+XF+163+213X+213X+69Y+775XY+285Y²+68XY², whereby a remainder 163+213X+69Y+775XY+285Y²+68XY² is obtained to generate a vector w⁽⁵⁾ ₂=(163,213,69,775,285,68). And, the vectors w⁽⁵⁾ ₁ and w⁽⁵⁾ ₂ are connected to obtain a vector v₅=(167,875,529,648,981,94,163,213,69,775,285,68).

Next, for a sixth monomial M₆=Y², divide Y²g=Y²(449+79X+320Y+XY) by f=982+226X+146Y+X² and F=Y³+X⁴+7X: then Y²g=(208+28X+915X²+1008X³+908Y+146XY)f+(320+X)F+571+949X+202Y+482XY+60Y²+961XY², whereby a remainder 571+949X+202Y+482XY+60Y²+961XY² is obtained to generate a vector w⁽⁶⁾ ₁=(571,949,202,482,60,961).

Also, divide Y²h=Y² (544+564X+195Y+Y²) by f=982+226X+146Y+X² and F=Y³+X⁴+7X: then Y²h=(1001+233X+941X²+194Y+226XY+1008X²Y+146Y²)f+(68+Y)F+793+560X+352Y+881XY+378Y²+157XY², whereby a remainder 793+560X+352Y+881XY+378Y2+157XY² is obtained to generate a vector w⁽⁶⁾ ₂=(793,560,352,881,378,157). And, the vectors w⁽⁶⁾ ₁ and w⁽⁶⁾ ₂ are connected to obtain a vector v₆=(571,949,202,482,60,961,793,560,352,881,378,157).

Finally, for a seventh monomial M₇=X³, divide X³g=X³(449+79X+320Y+XY) by f=982+226X+146Y+X² and F=Y³+X⁴+7X: then X³g=(370+198X+961X²+926Y+94XY+X²Y+863Y²) f+127F+909+548X+243Y+460XY+104Y²+101XY², whereby a remainder 909+548X+243Y+460XY+104Y²+101XY² is obtained to generate a vector w⁽⁷⁾ ₁=(909,548,243,460,104,101).

Also, divide X³h=X³ (544+564X+195Y+Y²) by f=982+226X+146Y+X² and F=Y³+X⁴+7X: then X³h=(834+283X+157X²+146X³+52Y+68XY+783Y²+XY²)f+(708+863X)F+320+866X+720Y+225XY+432Y²+815XY², whereby a remainder 320+866X+720Y+225XY+432Y²+815XY² is obtained to generate a vector w⁽⁷⁾ ₂=(320,866,720,225,432,815). And, the vectors w⁽⁷⁾ ₁ and w⁽⁷⁾ ₂ are connected to obtain a vector v₇=(909,548,243,460,104,101,320,866,720,225,432,815). Above, the process of the second ideal reduction section 13 reduction section 13 in the polynomial vector generation section 32 is finished.

Next, in the basis construction section 33, the second ideal reduction section 13 inputs seven 12-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇ generated in the polynomial vector generation section 32 into the linear-relation derivation section 34, and obtains a plurality of seven-dimensional vectors m₁,m₂, . . . as an output. The linear-relation derivation section 34 derives a linear relation of the vectors, which were input, employing a discharging method. The discharging method belongs to a known art, whereby as to an operation of the linear-relation derivation section 34, only its outline is shown below.

The linear-relation derivation section 34 firstly arranges the seven 12-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇, which were input, in order for constructing a 7×12 matrix

            [EQ.  17] $M_{R} = \begin{pmatrix} 449 & 79 & 320 & 1 & 0 & 0 & 544 & 564 & 195 & 0 & 1 & 0 \\ 115 & 757 & 601 & 94 & 863 & 0 & 93 & 214 & 394 & 195 & 0 & 1 \\ 0 & 0 & 449 & 79 & 320 & 1 & 531 & 305 & 942 & 157 & 68 & 0 \\ 259 & 563 & 988 & 546 & 402 & 863 & 900 & 27 & 669 & 611 & 189 & 783 \\ 167 & 875 & 529 & 648 & 981 & 94 & 163 & 213 & 69 & 775 & 285 & 68 \\ 571 & 949 & 202 & 482 & 60 & 961 & 793 & 560 & 352 & 881 & 378 & 157 \\ 909 & 548 & 243 & 460 & 104 & 101 & 320 & 866 & 720 & 225 & 432 & 815 \end{pmatrix}$

Next, the linear-relation derivation section 34 connects a seventh-dimensional unity matrix to the matrix M_(R) to construct

$\begin{matrix} {M_{R}^{\prime} = \begin{pmatrix} 449 & 79 & 320 & 1 & 0 & 0 & 544 & 564 & 195 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\ 115 & 757 & 601 & 94 & 863 & 0 & 93 & 214 & 394 & 195 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 449 & 79 & 320 & 1 & 531 & 305 & 942 & 157 & 68 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\ 259 & 563 & 988 & 546 & 402 & 863 & 900 & 27 & 669 & 611 & 189 & 783 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\ 167 & 875 & 529 & 648 & 981 & 94 & 163 & 213 & 69 & 775 & 285 & 68 & 0 & 0 & 0 & 0 & 1 & 0 & 0 \\ 571 & 949 & 202 & 482 & 60 & 961 & 793 & 560 & 352 & 881 & 378 & 157 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\ 909 & 548 & 243 & 460 & 104 & 101 & 320 & 866 & 720 & 225 & 432 & 815 & 0 & 0 & 0 & 0 & 0 & 0 & 1 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 18} \right\rbrack \end{matrix}$

Next, the linear-relation derivation section 34 triangulates a matrix M′_(R) by adding a constant multiple of an i-th row to an (i+1)-th row (i=1, 2, and 3) to a seventh row to obtain the following a matrix m.

$\begin{matrix} {m = \begin{pmatrix} 449 & 79 & 320 & 1 & 0 & 0 & 544 & 564 & 195 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 548 & 955 & 896 & 863 & 0 & 493 & 510 & 389 & 195 & 802 & 1 & 802 & 1 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 449 & 79 & 320 & 1 & 531 & 305 & 942 & 157 & 68 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 982 & 226 & 146 & 1 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 53 & 941 & 915 & 0 & 1 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 394 & 852 & 48 & 0 & 0 & 1 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 382 & 194 & 908 & 0 & 0 & 0 & 1 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 19} \right\rbrack \end{matrix}$

As well known, the vector that is composed of a thirteenth component and afterward of a fourth row to a seventh row of the matrix m is a vector {(m_(1,1),m_(1,2), . . . ,m_(1,n)), (m_(2,1),m_(2,2), . . . ,m_(2,n)), . . . } representing a linearly-independent linear dependence relation Σ_(i) ⁷m_(ji)v_(i)=0(j=1,2, . . . ) of all of the seven 12-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇ that were input. The linear-relation derivation section 34 outputs a vector m₁=(982,226,146,1,0,0,0) that is composed of the thirteenth component and afterward of the fourth row of the matrix m, a vector m₂=(53,941,915,0,1,0,0) that is composed of the thirteenth component and afterward of the fifth row of the matrix m, and a vector m₃=(394,852,48,0,0,1,0) that is composed of the thirteenth component and afterward of the sixth row of the matrix m, and a vector m₄=(382,194,908,0,0,0,1) that is composed of the thirteenth component and afterward of the seventh row of the matrix m.

Now return to the explanation of the process of the second ideal reduction section 13 in the basis construction section 33. Next, the second ideal reduction section 13 makes a reference to a table 37 for a Groebner basis construction of FIG. 7, and retrieves a record, of which the value of the order field is said value d=3, and in which a vector of which the components that correspond to all component numbers described in the component number list field are all zero does not lie in said plurality of said vectors m₁=(982,226,146,1,0,0,0), m₂=(53,941,915,0,1,0,0), m₃=(394,852,48,0,0,1,0), and m₄=(382,194,908,0,0,0,1). The value of the order field of a fourteenth record is 3, and a vector, of which the component that correspond to the component number lists 4, 5, 6, and 7 of the fourteenth record are all zero, does not lie in the vectors m₁, m₂, m₃, and m₄, whereby the fourteenth record is obtained as a retrieval result.

Furthermore, the value of the first vector type of the fourteenth record is (*,*,*,1,0,0,0)(A code * is interpreted as representing any number), which coincides with the vector m₁=(982,226,146,1,0,0,0), whereby the vector m₁ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, Y, X², XY, Y², and X³ of the algebraic curve parameter file A to generate a polynomial f₁=982+226X+146Y+X².

Similarly, the value of the second vector type of the fourteenth record is (*,*,*,0,1,0,0) (A code * is interpreted as representing any number), which coincides with the vector m₂=(53,941,915,0,1,0,0), whereby the vector m₂ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, Y, X², XY, Y², and X³ of the algebraic curve parameter file A to generate a polynomial f₂=53+941X+915Y+XY.

Similarly, the value of the third vector type of the fourteen record is (*,*,*,0,0,1,0) (A code * is interpreted as representing any number), which coincides with the vector m₃=(394,852,48,0,0,1,0), whereby the vector m₃ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, Y, X², XY, Y², and X³ of the algebraic curve parameter file A to generate a polynomial f₃=394+852X+48Y+Y². Finally, the ideal reduction section 13 constructs a set J**={f₁=982+226X+146Y+X², f₂=53+941X+915Y+XY,f₃=394+852X+48Y+Y²} of the polynomial output it. Above, the operation of the second ideal reduction section 13 is finished.

Finally, in the Jacobian group element adder of FIG. 1, the Groebner basis J**={982+226X+146Y+X², 53+941X+915Y+XY,394+852X+48Y+Y²}, which the second ideal reduction section 13 output, is output from an output apparatus.

Next, the embodiment of the case will be shown in which the C₂₇ curve was employed. In this embodiment, the algebraic curve parameter file of FIG. 8 is employed as an algebraic curve parameter file, the ideal type table of FIG. 9 as an ideal type table, the monomial list table of FIG. 10 as an monomial list table, and the table for a Groebner basis construction of FIG. 11 as a table for a Groebner basis construction respectively.

In the Jacobian group element adder of FIG. 1, suppose Groebner bases I ₁={689+623X+130X ² +X ³,568+590X+971X ² +Y} and I ₂={689+623X+130X ² +X ³, 568+590X+971X ² +Y} were input of the ideal of the coordinate ring of the algebraic curve designated by the algebraic curve parameter file A, which represents an element of the Jacobian group of the C₂₇ curve designated by the algebraic curve parameter file A 16 and the algebraic curve parameter file A of FIG. 8.

At first, an ideal composition section 11, which takes the algebraic curve parameter file A of FIG. 8, and the above-mentioned Groebner bases I₁ and I₂ as an input, operates as follows according to a flow of the process of the functional block shown in FIG. 2. At first, the ideal composition section 11 makes a reference to the ideal type table of FIG. 9 in the ideal type classification section 21 of FIG. 2, retrieves a record in which the ideal type described in the ideal type field accords with the type of the input ideal I₁ for obtaining an eleventh record, and acquires a value N₁=31 of the ideal type number field and a value d₁=3 of the order field of the eleventh record. Similarly, the ideal composition section 11 retrieves a record in which the ideal type accords with the type of the input ideal I₂ for obtaining the eleventh record, and acquires a value N₂=31 of the ideal type number field and a value d₂=3 of the order field of the eleventh record.

Next, the ideal composition section 11 calculates the sum d₃=d₁+d₂=6 of said values d₁=3 and d₂=3 of said order field in the monomial vector generation section 22, makes a reference to the monomial list table, retrieves a record of which the value of the order field is said d₃=6 for obtaining a first record, and acquires a list 1, X, X², X³, Y, X⁴, XY, X⁵, X²Y, and X⁶ of the monomial described in the monomial list field of the first record. I₁ and I₂ are equivalent, whereby a remainder to be attained by dividing M_(i) by I₁ for each of M_(i)(1<=i<=10) in said list 1, X, X², X³, Y, X⁴, XY, X⁵, X²Y, and X⁶ of said monomial is calculated to obtain a polynomial a^((i)) ₁+a^((i)) ₂X+a^((i)) ₃X², to arrange its coefficients in order of the monomial order 1, X, X², . . . of the algebraic curve parameter file A, and to generate a vector w^((i)) ₁=(a^((i)) ₁,a^((i)) ₂,a^((i)) ₃).

Furthermore, the ideal composition section 11 regards a coefficient list 0, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, and 1 described in the algebraic curve parameter file A of FIG. 8 as a coefficient row of each monomial of the monomial order 1, X, X², X³, Y, X⁴, XY, X⁵, X²Y, X⁶, X³Y, X⁷, and Y² described in the algebraic curve parameter file A of FIG. 8, constructs a defining polynomial F=Y²+X⁷+7X, when a differential of a polynomial M with respect to its X is expressed by D_(X)(M), and a differential of a polynomial M with respect to its Y is expressed by D_(Y)(M), calculates a remainder to be attained by dividing a polynomial D_(X)(M_(i))D_(Y)(F)−D_(Y)(M_(i))D_(X)(F) by I₁, obtains a polynomial b^((i)) ₁+b^((i)) ₂X+b^((i)) ₃X², arranges its coefficients in order of the monomial order 1, X, X², . . . of the algebraic curve parameter file A, generates a vector w^((i)) ₂=(b^((i)) ₁,b^((i)) ₂,b^((i)) ₃), and connect the above-mentioned two vectors w^((i)) ₁ and w^((i)) ₂ for generating a vector v_(i)=(a^((i)) ₁,a^((i)) ₂,a^((i)) ₃,b^((i)) ₁,b^((i)) ₂,b^((i)) ₃). That is, divide M₁=1 by I₁: then 1=0·(689+623X+130X ² +X ³)+0·(568+590X+971X ² +Y)+1, whereby, 1 is obtained as a remainder to generate a vector w⁽¹⁾ ₁=(1,0,0). Furthermore, divide D_(X)(1)D_(Y)(F)−D_(Y)(1)D_(X)(F)=0 by I₁: then 0, whereby 0 is obtained as a remainder to generate a vector w⁽¹⁾ ₂=(0,0,0). w⁽¹⁾ ₁ and w⁽¹⁾ ₂ are connected to generate a vector v₁=(1,0,0,0,0,0).

Next, divide M₂=X by I₁: then X=0·(689+623X+130X²+X³)+0·(568+590X+971X²+Y)+X, whereby, X is obtained as a remainder to generate a vector w⁽²⁾ ₁=(0,1,0). Furthermore, divide D_(X)(X)D_(Y)(F)−D_(Y)(X)D_(X)(F)=D_(Y)(F)=2Y by I₁: then 2Y=0·(689+623X+130X²+X³)+2(568+590X+971X²+Y)+882+838X+76X²,

whereby 882+838X+76X² is obtained as a remainder to generate a vector w⁽²⁾ ₂=(882,838,76). w⁽²⁾ ₁ and w⁽²⁾ ₂ are connected to generate a vector v₂=(0,1,0,882,838,76)

Next, divide M₃=X² by I₁: then X²=0·(689+623X+130X²+X³)+0·(568+590X+971X²+Y)+X², whereby, X² is obtained as a remainder to generate a vector w⁽³⁾ ₁=(0,0,1). Furthermore, divide D_(X)(X²)D_(Y)(F)−D_(Y)(X²)D_(X)(F)=4XY by I₁: then 4XY=152(689+623X+130X²+X³)+4X(568+590X+971X²+Y)+208+905X+78X², whereby 208+905X+78X² is obtained as a remainder to generate a vector w⁽³⁾ ₂=(208,905,78). w⁽³⁾ ₁ and w⁽³⁾ ₂ are connected to generate a vector v₃=(0,0,1,208,905,78).

Next, divide M₄=X³ by I₁: then X³=1·(689+623X+130X²+X³)+0·(568+590X+971X²+Y)+320+386X+879X², whereby, 320+386X+879X² is obtained as a remainder to generate a vector w⁽⁴⁾ ₁=(320,386,879). Furthermore, divide D_(X)(X³)D_(Y)(F)−D_(Y)(X³)D_(X)(F)=6X²Y by I₁: then 6X²Y=(117+228X)(689+623X+130X²+X³)+6X²(568+590X+971X²+Y)+107+69X+778X², whereby 107+69X+778X² is obtained as a remainder to generate a vector w⁽⁴⁾ ₂=(107,69,778). w⁽⁴⁾ ₁ and w⁽⁴⁾ ₂ are connected to generate a vector v₄=(320,386,879,107,69,778).

Next, divide M₅=Y by I₁: then Y=0·(689+623X+130X²+X³)+1·(568+590X+971X²+Y)+441+419X+38X², whereby, 441+419X+38X² is obtained as a remainder to generate a vector w⁽⁵⁾ ₁=(441,419,38). Furthermore, divide D_(X)(Y)D_(Y)(F)−D_(Y)(Y)D_(X)(F)=−D_(X)(F)=1002+1002X⁶ by I₁, then 1002+1002X⁶=(865+78X+910X²+1002X³)(689+623X+130X²+X³)+0·(568+590X+971X²+Y)+327+655X+1004X², whereby 327+655X+1004X² is obtained as a remainder to generate a vector w⁽⁵⁾ ₂=(327,655,1004). w⁽⁵⁾ ₁ and w⁽⁵⁾ ₂ are connected to generate a vector v₅=(441,419,38,327,655,1004).

Next, divide M₆=X⁴ by I₁: then X⁴=(879+X)(689+623X+130X²+X³)+0·(568+590X+971X²+Y)+778+590X+133X², whereby, 778+590X+133X² is obtained as a remainder to generate a vector w⁽⁶⁾ ₁=(778,590,133). Furthermore, divide D_(X)(X⁴)D_(Y)(F)−D_(Y)(X⁴) D_(X)(F)=8X³Y by I₁: then 8X³Y=(200+840X+8Y)(689+623X+130X²+X³)+(542+61X+978X²) (568+590X+971X²+Y)+322+653X+781X², whereby 322+653X+781X² is obtained as a remainder to generate a vector w⁽⁶⁾ ₂=(322,653,781). w⁽⁶⁾ ₁ and w⁽⁶⁾ ₂ are connected to generate a vector v₆=(778,590,133,322,653,781).

Next, divide M₇=XY by I₁: then XY=38(689+623X+130X²+X³)+X(568+590X+971X²+Y)+52+983X+524X², whereby, 52+983X+524X² is obtained as a remainder to generate a vector w⁽⁷⁾ ₁=(52,983,524). Furthermore, divide D_(X)(XY)D_(Y)(F)−D_(Y)(XY)D_(X)(F)=1002X+1002X⁷+2Y² by I₁, then 1002X+1002X⁷+2Y²=(24+726X+78X²+910X³+1002X⁴) (689+623X+130X²+X³)+(882+838X+76X²+2Y)(568+590X+971X²+Y)+105+954X+813X², whereby 105+954X+813X² is obtained as a remainder to generate a vector w⁽⁷⁾ ₂=(105,954,813). w⁽⁷⁾ ₁ and w⁽⁷⁾ ₂ are connected to generate a vector v₇=(52,983,524,105,954,813).

Next, divide M₈=X⁵ by I₁: then X⁵=(133+879X+X²)(689+623X+130X²+X³)+0·(568+590X+971X²+Y)+182+657X+453X², whereby, 182+657X+453X² is obtained as a remainder to generate a vector w⁽⁸⁾ ₁=(182,657,453). Furthermore, divide D_(X)(X⁵)D_(Y)(F)−D_(Y)(X⁵)D_(X)(F)=10X⁴Y by I₁: then 10X⁴Y=(912+90X+718Y+10XY)(689+623X+130X²+X³)+(717+855X+321X²)(568+590X+971X²+Y)+619+878X+281X², whereby 619+878X+281X² is obtained as a remainder to generate a vector w⁽⁸⁾ ₂=(619,878,281). w⁽⁸⁾ ₁ and w⁽⁸⁾ ₂ are connected to generate a vector v₈=(182,657,453,619,878,281).

Next, divide M₉=X²Y by I₁: then X²Y=(524+38X)(689+623X+130X²+X³)+X² (568+590X+971X²+Y)+186+516X+466X², whereby, 186+516X+466X² is obtained as a remainder to generate a vector w⁽⁹⁾ ₁=(186,516,466) Furthermore, divide D_(X)(X²Y)D_(Y)(F)−D_(Y)(X²Y)D_(X)(F)=1002X²+1002X⁸+4XY² by I₁: then 1002X²⁺¹⁰⁰²X⁸+4XY²=(892+941X+865X²+78X³+910X⁴+1002X⁵+152Y) (689+623X+130X²+X³)+(208+905X+78X²+4XY)(568+590X+971X²+Y)+811+600X+123X², whereby 811+600X+123X² is obtained as a remainder to generate a vector w⁽⁹⁾ ₂=(811,600,123). w⁽⁹⁾ ₁ and w⁽⁹⁾ ₂ are connected to generate a vector v₉=(186,516,466,811,600,123).

Next, divide M₁₀=X⁶ by I₁: then X⁶=(453+133X+879X²+X³)(689+623X+130X²+X³)+0·(568+590X+971X²+Y)+673+483X+289X², whereby, 673+483X+289X² is obtained as a remainder to generate a vector w⁽¹⁰⁾ ₁=(673,483,289). Furthermore, divide D_(X)(X⁶)D_(Y)(F)−D_(Y)(X⁶)D_(X)(F)=12X⁵Y by I₁: then 12X⁵Y=(985+732X+587Y+458XY+12X²Y)(689+623X+130X²+X³)+(166+821X+391X²)(568+590X+971X²+Y)+950+741X+201X², whereby 950+741X+201X² is obtained as a remainder to generate a vector w⁽¹⁰⁾ ₂=(950,741,201). w⁽¹⁰⁾ ₁ and w⁽¹⁰⁾ ₂ are connected to generate a vector v₁₀=(673,483,289,950,741,201). Above, the process of the ideal composition section 11 in the monomial vector generation section 22 is finished.

Next, in the basis construction section 23, the ideal composition section 11 inputs ten six-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, v₇, v₆, v₉, and, v₁₀ generated in the monomial vector generation section 22 into the linear-relation derivation section 24, and obtains a plurality of 10-dimensional vectors m₁,m₂, . . . as an output. The linear-relation derivation section 24 derives a linear relation of the vectors, which were input, employing the discharging method. The discharging method belongs to a known art, whereby, as to an operation of the linear-relation derivation section 24, only its outline is shown below. The linear-relation derivation section 24 firstly arranges the ten six-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, v₇, v₈, v₉, and, v₁₀ which were input, in order for constructing a 10×6 matrix

$\begin{matrix} {M_{C} = \begin{pmatrix} 1 & 0 & 0 & 0 & 0 & 0 \\ 0 & 1 & 0 & 882 & 838 & 76 \\ 0 & 0 & 1 & 208 & 905 & 78 \\ 320 & 386 & 879 & 107 & 69 & 778 \\ 441 & 419 & 38 & 327 & 655 & 1004 \\ 778 & 590 & 133 & 322 & 653 & 781 \\ 52 & 983 & 524 & 105 & 954 & 813 \\ 182 & 657 & 453 & 619 & 878 & 281 \\ 186 & 516 & 466 & 811 & 600 & 123 \\ 673 & 483 & 289 & 950 & 741 & 201 \end{pmatrix}} & \left\lbrack {E\;{Q.\mspace{14mu} 20}} \right\rbrack \end{matrix}$

Next, the linear-relation derivation section 24 connects a 10-dimensional unity matrix to the matrix M_(C) to obtain

           [E Q.  21] $M_{C}^{\prime} = \begin{pmatrix} 1 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 1 & 0 & 882 & 838 & 76 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 1 & 208 & 905 & 78 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 320 & 386 & 879 & 107 & 69 & 778 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\ 441 & 419 & 38 & 327 & 655 & 1004 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\ 778 & 590 & 133 & 322 & 653 & 781 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\ 52 & 983 & 524 & 105 & 954 & 813 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\ 182 & 657 & 453 & 619 & 878 & 281 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 \\ 186 & 516 & 466 & 811 & 600 & 123 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\ 673 & 483 & 289 & 950 & 741 & 201 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 \end{pmatrix}$

Next, the linear-relation derivation section 24 triangulates a matrix M′_(C) by adding a constant multiple of an i-th row to an (i+1)-th row (i=1,2, . . . , 6) to a tenth row to obtain the following a matrix m.

                                       [EQ.  22] $\;{m = \left( \begin{matrix} 1 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 1 & 0 & 882 & 838 & 76 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 1 & 208 & 905 & 78 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 494 & 87 & 753 & 689 & 623 & 130 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 477 & 924 & 591 & 170 & 804 & 22 & 1 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 475 & 742 & 22 & 242 & 149 & 314 & 1 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 699 & 601 & 688 & 281 & 217 & 287 & 1 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 193 & 959 & 364 & 180 & 550 & 43 & 0 & 1 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 780 & 667 & 96 & 50 & 897 & 327 & 0 & 0 & 1 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 761 & 727 & 417 & 523 & 278 & 912 & 0 & 0 & 0 & 1 \end{matrix} \right)}$

As well known, the vector that is composed of a seventh component and afterward of a seventh row to a tenth row of the matrix m is a vector {(m_(1,1),m_(1,2), . . . ,m_(1,n)), m_(2,1),m_(2,2), . . . ,m_(2,n)), . . . } representing a linearly-independent linear dependence relation Σ_(i) ¹⁰m_(ji)v_(i)=0(j=1,2, . . . ) of all of the ten six-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, v₇, v₈, v₉, and, v₁₀ that were input. The linear-relation derivation section 24 outputs a vector m₁=(699,601,688,281,217,287,1,0,0,0) that is composed of the seventh component and afterward of the seventh row of the matrix m, a vector m₂=(193,959,364,180,550,43,0,1,0,0) that is composed of the seventh component and afterward of the eighth row of the matrix m, and a vector m₃=(780,667,96,50,897,327,0,0,1,0) that is composed of the seventh component and afterward of the ninth row of the matrix m, and a vector m₄=(761,727,417,523,278,912,0,0,0,1) that is composed of the seventh component and afterward of the tenth row of the matrix m. Now return to the explanation of the process of the ideal composition section 11 in the basis construction section 23.

Next, the ideal composition section 11 makes a reference to the table for a Groebner basis construction of FIG. 11, and retrieves a record, of which the value of the order field is said value d₃=6, and in which a vector of which the components that correspond to all component numbers described in the component number list field are all zero does not lie in said plurality of said vectors m₁=(699,601,688,281,217,287,1,0,0,0), m₂=(193,959,364,180,550,43,0,1,0,0), m₃=(780,667,96,50,897,327,0,0,1,0), and m₄=(761,727,417,523,278,912,0,0,0,1). The value of the order field of the first record is 6, and a vector, of which the components correspond to the component number lists 7, 8, 9, and 10 of a first record are all zero, does not lie in the vectors m₁, m₂, m₃, and m₄, whereby the first record is obtained as a retrieval result.

Furthermore, the value of the first vector type of the first record is (*,*,*,*,*,*,1,0,0,0)(A code * is interpreted as representing any number), which coincides with the vector m₁=(699,601,688,281,217,287,1,0,0,0), whereby the vector m₁ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, X², X³, Y, X⁴, XY, X⁵, X²Y, and X⁶ of the algebraic curve parameter file A to generate a polynomial f₁=699+601X+688X²+281X³+217Y+287X⁴+XY.

Similarly, the value of the second vector type of the first record is (*,*,*,*,*,*,0,1,0,0) (A code * is interpreted as representing any number), which coincides with the vector m₂=(193,959,364,180,550,43,0,1,0,0), whereby the vector m₂ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, X², X³, Y, X⁴, XY, X⁵, X²Y, and X⁶ of the algebraic curve parameter file A to generate a polynomial f₂=193+959X+364X²+180X³+550Y+43X⁴+X⁵. The value of third vector type of the first record is null, whereby it is neglected. Finally, the ideal composition section 11 constructs a set J={f₁,f₂}={699+601X+688X²+281X³+217Y+287X⁴+XY,193+959X+364X²+180X³+550Y+43X⁴+X⁵} of the polynomial to output it. Above, the operation of the ideal composition section 11 is finished.

Next, the first ideal reduction section 12, which takes as an input the algebraic curve parameter file A of FIG. 8, and the Groebner basis J={699+601X+688X²+281X³+217Y+287X⁴+XY, 193+959X+364X²+180X³+550Y+43X⁴X⁵} that the ideal composition section 11 output, operates as follows according to a flow of the process of the functional block shown in FIG. 3.

At first, in the ideal type classification section 31 of FIG. 3, the ideal reduction section 12 makes a reference to the ideal type table of FIG. 9, retrieves a record in which the ideal type described in the ideal type field accords with the type of the input ideal J for obtaining a first record, and acquires a value N=61 of the ideal type number field and a value d=3 of the reduction order field of the first record. Next, the ideal reduction section 12 confirms that said value d=3 is not zero, makes a reference to the monomial list table of FIG. 10 in the polynomial vector generation section 32, retrieves a record of which the value of the order field is said d=3 for obtaining a fourth record, and acquires a list 1, X, X², X³, Y, X⁴, and XY of the monomial described in the monomial list field of the fourth record.

Furthermore, the ideal reduction section 12 acquires a first element f=699+601X+688X²+281X³+217Y+284X⁴+XY of J, and a second element g=193+959X+364X²+180X³+550Y+43X⁴+X⁵(A third element does not lie in J, whereby a third polynomial h is not employed), regards a coefficient list 0,7,0,0,0,0,0,0,0,0,0,1,1 of the algebraic curve parameter file A as a column of the coefficient of each monomial of the monomial order 1, X, X², X³, Y, X⁴, XY, X⁵, X²Y, X⁶, X³Y, X⁷ and Y² of the algebraic curve parameter file A, and generates a defining polynomial F=Y²+X⁷+7X.

Next, for each of M_(i)(1<=i<=7) in said list 1, X, X², X³, Y, X⁴ and XY of said monomial, the ideal reduction section 12 calculates a remainder equation r_(i) of a product Mi·g of M_(i) and the polynomial g by the polynomials f and F, arranges its coefficients in order of the monomial order 1, X, X², X³, Y, X⁴, XY, X⁵, X²Y, X⁶, X³Y, and X⁷ of the algebraic curve parameter file A, and generates a vector v_(i). That is, at first, for a first monomial M₁=1, divide 1·g=193+959X+364X²+180X³+550Y+43X⁴+X⁵ by f=699+601X+688X²+281X³+217Y+287X⁴+XY and F=Y²+X⁷+7X: then g=0·f+0·F+193+959X+364X²+180X³+550Y+43X⁴+X⁵, whereby a remainder 193+959X+364X²+180X³+550Y+43X⁴+X⁵ is obtained to generate a vector v₁=(193,959,364,180,550,43,0,1,0,0,0,0).

Next, for a second monomial M₂=X, divide Xg=X(193+959X+364X²+180X³+550Y+43X⁴+X⁵) by f=699+601X+688X²+281X³+217Y+287X⁴+XY and F=Y²+X⁷+7X: then Xg=550f+0·F+988+595X+934X²+191X³+743X⁴+43X⁵+X⁶+721Y, whereby a remainder 988+595X+934X²+191X³+743X⁴+43X⁵+X⁶+721Y is obtained to generate a vector v₂=(988,595,934,191,721,743,0,43,0,1,0,0).

Next, for a third monomial M₃=X², divide X²g=X²(193+959X+364X²+180X³+550Y+43X⁴+X⁵) by f=699+601X+688X²+281X³+217Y+287X⁴+XY and F=Y²+X⁷+7X: then X²g=(721+550X)f+0·F+521+528Y+975X²+133X³+109X⁴+743X⁵+43X⁶+X⁷+947Y, whereby a remainder 521+528X+975X²+133X³+109X⁴+743X⁵+43X⁶+X⁷+947Y is obtained to generate a vector v₃=(521,528,975,133,947,109,0,743,0,43,0,1).

Next, for a fourth monomial M₄=X³, divide X³g=X³(193+959X+364X²+180X³+550Y+43X⁴+X⁵) by f=699+601X+688X²+281X³+217Y+287X⁴+XY and F=Y²+X⁷+7X: then X³g=(200+969X+101X²+287X³+1008Y)f+(217+X)F+451+78X+481X²+791X³+389X⁴+924X⁵+527X⁶+195X⁷+686Y, whereby a remainder 451+78X+481X²+791X³+389X⁴+924X⁵+527X⁶+195X⁷+686Y is obtained to generate a vector v₄=(451,78,481,791,686,389,0,924,0,527,0,195).

Next, for a fifth monomial M₅=Y, divide Yg=Y(193+959X+364X²+180X³+550Y+43X⁴+X⁵) by f=699+601X+688X²+281X³+217Y+287X⁴+XY and F=Y²+X⁷+7X: then Yg=(884+712X+316X²+195X³+X⁴+287Y)f+(829+722X)F+601+459X+217X²+14X³+965X⁴+924X⁵+130X⁶+438X⁷+253Y, whereby a remainder 601+459X+217X²+14X³+965X⁴+924X⁵+130X⁶+438X⁷+253Y is obtained to generate a vector v₅=(601,459,217,14,253,965,0,924,0,130,0,438).

Next, for a sixth monomial M₆=X⁴, divide X⁴g=X⁴(193+959X+364X²+180X³+550Y+43X⁴+X⁵) by f=699+601X+688X²+281X³+217Y+287X⁴+XY and F=Y²+X⁷+7X: then X⁴g=(317+128X+188X²+571X³+287X⁴+814Y+1008XY)f+(946+412X+X²) F+397+954X+514X²+891X³+255X⁴+901X⁵+173X⁶+906X⁷+922Y, whereby a remainder 397+954X+514X²+891X³+255X⁴+901X⁵+173X⁶+906X⁷+922Y is obtained to generate a vector v₆=(397,954,514,891,922,255,0,901,0,173,0,906).

Finally, for a seventh monomial M₇=XY, divide XYg=XY(193+959X+364X²+180X³+550Y+43X⁴+X⁵) by f=699+601X+688X²+281X³+217Y+287X⁴+XY and F=Y²+X⁷+7X: then XYg=(992+536X+805X²+906X³+195X⁴+X⁵+571Y+287XY)f+(200+258X+722X²)F+784+420X+871X²+113X³+933X⁴+749X⁵+153X⁶+112X⁷+88Y, whereby a remainder 784+420X+871X²+113X³+933X⁴+749X⁵+153X⁶+112X⁷+88 is obtained to generate a vector v₇=(784,420,871,113,88,933,0,749,0,153,0,112). Above, the process of the second ideal reduction section 12 in the polynomial vector generation section 32 is finished.

Next, in the basis construction section 33, the second ideal reduction section 12 inputs seven 12-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇ generated in the polynomial vector generation section 32 into the linear-relation derivation section 34, and obtains a plurality of seven-dimensional vectors m₁, m₂, . . . as an output.

The linear-relation derivation section 34 derives a linear relation of the vectors, which were input, employing the discharging method. The discharging method belongs to a known art, whereby, as to an operation of the linear-relation derivation section 34, only its outline is shown below. The linear-relation derivation section 34 firstly arranges the seven 12-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇, which were input, in order for constructing a 7×12 matrix

$\begin{matrix} {M_{R} = \begin{pmatrix} 193 & 959 & 364 & 180 & 550 & 43 & 0 & 1 & 0 & 0 & 0 & 0 \\ 988 & 595 & 934 & 191 & 721 & 743 & 0 & 43 & 0 & 1 & 0 & 0 \\ 521 & 528 & 975 & 133 & 947 & 109 & 0 & 743 & 0 & 43 & 0 & 1 \\ 451 & 78 & 481 & 791 & 686 & 389 & 0 & 924 & 0 & 527 & 0 & 195 \\ 601 & 459 & 217 & 14 & 253 & 965 & 0 & 924 & 0 & 130 & 0 & 438 \\ 397 & 954 & 514 & 891 & 922 & 255 & 0 & 901 & 0 & 173 & 0 & 906 \\ 784 & 420 & 871 & 113 & 88 & 933 & 0 & 749 & 0 & 153 & 0 & 112 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 23} \right\rbrack \end{matrix}$

Next, the linear-relation derivation section 34 connects a seven-dimensional unity matrix to the matrix M_(R) to construct

$\begin{matrix} {M_{R}^{\prime} = \begin{pmatrix} 193 & 959 & 364 & 180 & 550 & 43 & 0 & 1 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\ 988 & 595 & 934 & 191 & 721 & 743 & 0 & 43 & 0 & 1 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\ 521 & 528 & 975 & 133 & 947 & 109 & 0 & 743 & 0 & 43 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\ 451 & 78 & 481 & 791 & 686 & 389 & 0 & 924 & 0 & 527 & 0 & 195 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\ 601 & 459 & 217 & 14 & 253 & 965 & 0 & 924 & 0 & 130 & 0 & 438 & 0 & 0 & 0 & 0 & 1 & 0 & 0 \\ 397 & 954 & 514 & 891 & 922 & 255 & 0 & 901 & 0 & 173 & 0 & 906 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\ 784 & 420 & 871 & 113 & 88 & 933 & 0 & 749 & 0 & 153 & 0 & 112 & 0 & 0 & 0 & 0 & 0 & 0 & 1 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 24} \right\rbrack \end{matrix}$

Next, the linear-relation derivation section 34 triangulates a matrix M′_(R) by adding a constant multiple of an i-th row to an (i+1)-th row (i=1,2,3) to a seventh row to obtain the following a matrix m.

$\begin{matrix} {m = \begin{pmatrix} 193 & 959 & 364 & 180 & 550 & 43 & 0 & 1 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 485 & 524 & 587 & 922 & 434 & 0 & 247 & 0 & 1 & 0 & 0 & 204 & 1 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 362 & 736 & 914 & 919 & 0 & 822 & 0 & 725 & 0 & 1 & 14 & 682 & 1 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 804 & 795 & 814 & 1 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 522 & 542 & 571 & 0 & 1 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 385 & 443 & 103 & 0 & 0 & 1 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 12 & 627 & 897 & 0 & 0 & 0 & 1 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 25} \right\rbrack \end{matrix}$

As well known, the vector that is composed of a thirteenth component and afterward of a fourth row to a seventh row of the matrix m is a vector {(m_(1,1),m_(1,2), . . . ,m_(1,7)), (m_(2,1),m_(2,2), . . . ,m_(2,7)), . . . } representing a linearly-independent linear dependence relation Σ_(i=1) ⁷m_(ji)v_(i)=0(j=1,2, . . . ) of all of the seven 12-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇ that were input. The linear-relation derivation section 34 outputs a vector m₁=(804,795,814,1,0,0,0) that is composed of the thirteen component and afterward of the fourth row of the matrix m, a vector m₂=(522,542,571,0,1,0,0) that is composed of the thirteenth component and afterward of the fifth row of the matrix m, and a vector m₃=(385,443,103,0,0,1,0) that is composed of the thirteenth component and afterward of the sixth row of the matrix m, and a vector m₄=(12,627,897,0,0,0,1) that is composed of the thirteen component and afterward of the seventh row of the matrix m.

Now return to the explanation of the process of the first ideal reduction section 12 in the basis construction section 33. Next, this second ideal reduction section 12 makes a reference to the table for a Groebner basis construction of FIG. 11, retrieves a record of which the value of the order field is said value d=3, and in which a vector of which the components that correspond to all component numbers described in the component number list field are all zero does not lie in said plurality of said vectors m₁=(804,795,814,1,0,0,0), m₂=(522,542,571,0,1,0,0), m₃=(385,443,103,0,0,1,0), and m₄=(12,627,897,0,0,0,1). The value of the order field of an eleventh record is 3, and a vector, of which the components that correspond to the component number lists 4, 5, 6, and 7 of the eleventh record are all zero, does not lie in the vectors m₁, m₂, m₃, and m₄, whereby the eleventh record is obtained as a retrieval result.

Furthermore, the value of the first vector type of the eleventh record is (*,*,*,1,0,0,0) (A code * is interpreted as representing any number), which coincides with the vector m₁=(804,795,814,1,0,0,0), whereby the vector m₁ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, X², X³, Y, X⁴, and XY of the algebraic curve parameter file A to generate a polynomial f₁=804+795X+814X²+X³.

Similarly, the value of the second vector type of the eleventh record is (*,*,*,0,1,0,0) (A code * is interpreted as representing any number), which coincides with the vector m₂=(522,542,571,0,1,0,0), whereby the vector m₂ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, X², X³, Y, X⁴, and XY of the algebraic curve parameter file A to generate a polynomial f₂=522+542X+571X²+Y. The value of the third vector type of the eleventh record is null, whereby it is neglected. Finally, the ideal reduction section 12 constructs a set J*={f₁,f₂}={804+795X+814X²+X³,522+542X+571X²+Y} of the polynomial to output it. Above, the operation of the first ideal reduction section 12 is finished.

Next, the second ideal reduction section 13, which takes as an input the algebraic curve parameter file A of FIG. 8, and the Groebner basis J*={f₁,f₂}={804+795X+814X²+X³,522+542X+571X²+Y} that the first ideal reduction section 12 output, operates as follows according to a flow of the process of the functional block shown in FIG. 3. At first, the ideal reduction section 13 makes a reference to the ideal type table of FIG. 9 in the ideal type classification section 31 of FIG. 3, retrieves a record in which the ideal type described in the ideal type field accords with the type of the input ideal J* for obtaining an eleventh record, and acquires a value N=31 of the ideal type number field and a value d=3 of the reduction order field of the eleventh record.

Next, the ideal reduction section 13 confirms that said value d=3 is not zero, makes a reference to the monomial list table of FIG. 10 in the polynomial vector generation section 32, retrieves a record of which the value of the order field is said d=3 for obtaining a fourth record, and acquires a list 1, X, X², X³, Y, X⁴, and XY of the monomial described in the monomial list field of the fourth record. Furthermore, the ideal reduction section 13 acquires a first element f=804+795X+814X²+X³, and a second element g=522+542X+571X²+Y of J* (A third element does not lie in J*, whereby a third polynomial h is not employed), regards a coefficient list 0, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, and 1 of the algebraic curve parameter file A as a column of the coefficient of each monomial of the monomial order 1, X, X², X³, Y, X⁴, XY, X⁵, X²Y, X⁶, X³Y, X⁷ and Y² of the algebraic curve parameter file A, and generates a defining polynomial F=Y²+X⁷+7X.

Next, for each of M_(i)(1<=i<=7) in said list 1, X, X², X³, Y, X⁴ and XY of said monomial, the ideal reduction section 13 calculates a remainder equation r_(i) of a product M_(i)·g of M_(i) and the polynomial g by the polynomials f and F, arranges its coefficients in order of the monomial order 1, X, X², X³, Y, X⁴, XY, X⁵, X²Y, X⁶, X³Y, and X⁷ of the algebraic curve parameter file A, and generates a vector v_(i). That is, at first, for a first monomial M₁=1, divide 1·g=522+542X+571X²+Y by f=804+795X+814X²+X³ and F=Y²+X⁷+7X: then g=0·f+0·F+522+542X+571X²+Y, whereby a remainder 522+542X+571X²+Y is obtained to generate a vector v₁=(522,542,571,0,1,0,0,0,0).

Next, for a second monomial M₂=X, divide Xg=X(522+542X+571X²+Y) by f=804+795X+814X²+X³ and F=Y²+X⁷+7X: then Xg=571f+0·F+11+627X+897X²+XY, whereby a remainder 11+627X+897X²+XY is obtained to generate a vector v₂=(11,627,897,0,0,0,1,0,0).

Next, for a third monomial M₃=X², divide X²g=X²(522+542X+571X²+Y) by f=804+795X+814X²+X³ and F=Y²+X⁷+7X: then X²g=(897+571X)f+0·F+247+259X+985X²+X²Y, whereby a remainder 247+259X+985X²+X²Y is obtained to generate a vector v₃=(247,259,985,0,0,0,0,0,1).

Next, for a fourth monomial M₄=X³, divide X³g=X³(522+542X+571X²+Y) by f=804+795X+814X²+X³ and F=Y²+X⁷+7X: then X³g=(985+897X+571X²+Y)f+0·F+125+156X+624X²+205Y+214XY+195X²Y, whereby a remainder 125+156X+624X²+205Y+214XY+195X²Y is obtained to generate a vector v₄=(125,156,624,0,205,0,214,0,195).

Next, for a fifth monomial M₅=Y, divide Yg=Y(522+542X+571X²+Y) by f=804+795X+814X²+X³ and F=Y²+X⁷+7X: then Yg=(486+348X+103X²+814X³+1008X⁴)f+1·F+748+780X+665X²+522Y+542XY+571X²Y, whereby a remainder 748+780X+665X²+522Y+542XY+571X²Y is obtained to generate a vector v₅=(748,780,665,0,522,0,542,0,571).

Next, for a sixth monomial M₆=X⁴, divide X⁴g=X⁴(522+542X+571X²+Y) by f=804+795X+814X²+X³ and F=Y²+X⁷+7X: then X⁴g=(624+985X+897X²+571X³+195Y+XY)f+0·F+786+473X+756X²+624Y+566XY+906X²Y, whereby a remainder 786+473X+756X²+624Y+566XY+906X²Y is obtained to generate a vector v₆=(786,473,756,0,624,0,566,0,906).

Finally, for a seventh monomial M₇=XY, divide XYg=XY(522+542X+571X²+Y by f=804+795X+814X²+X³ and F=Y2+X⁷+7X: then XYg=(665+486X+348X²+103X³+814X⁴+1008X⁵+571Y) f+XF+110+789X+294X²+11Y+627XY+897X²Y, whereby a remainder 110+789X+294X²+11Y+627XY+897X²Y is obtained to generate a vector v₇=(110,789,294,0,11,0,627,0,897). Above, the process of the second ideal reduction section 13 in the polynomial vector generation section 32 is finished.

Next, in the basis construction section 33, this ideal reduction section 13 inputs seven nine-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇ generated in the polynomial vector generation section 32 into the linear-relation derivation section 34, and obtains a plurality of seven-dimensional vectors m₁, m₂, . . . as an output. The linear-relation derivation section 34 derives a linear relation of the vectors, which were input, employing the discharging method. The discharging method belongs to a known art, whereby, as to the operation of the linear-relation derivation section 34, only its outline is shown below.

The linear-relation derivation section 34 firstly arranges the seven nine-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇, which were input, in order for constructing a 7×9 matrix

$\begin{matrix} {M_{R} = \begin{pmatrix} 522 & 542 & 571 & 0 & 1 & 0 & 0 & 0 & 0 \\ 11 & 627 & 897 & 0 & 0 & 0 & 1 & 0 & 0 \\ 247 & 259 & 985 & 0 & 0 & 0 & 0 & 0 & 1 \\ 125 & 156 & 624 & 0 & 205 & 0 & 214 & 0 & 195 \\ 784 & 780 & 665 & 0 & 522 & 0 & 542 & 0 & 571 \\ 786 & 473 & 756 & 0 & 624 & 0 & 566 & 0 & 906 \\ 110 & 789 & 294 & 0 & 11 & 0 & 627 & 0 & 897 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 26} \right\rbrack \end{matrix}$

Next, the linear-relation derivation section 34 connects a seven-dimensional unity matrix to the matrix M_(R) to construct

            [EQ.  27] $M_{R}^{\prime} = \left( \begin{matrix} 522 & 542 & 571 & 0 & 1 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\ 11 & 627 & 897 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\ 247 & 259 & 985 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\ 125 & 156 & 624 & 0 & 205 & 0 & 214 & 0 & 195 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\ 748 & 780 & 665 & 0 & 522 & 0 & 542 & 0 & 571 & 0 & 0 & 0 & 0 & 1 & 0 & 0 \\ 786 & 473 & 756 & 0 & 624 & 0 & 566 & 0 & 906 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\ 110 & 789 & 294 & 0 & 11 & 0 & 627 & 0 & 897 & 0 & 0 & 0 & 0 & 0 & 0 & 1 \end{matrix} \right)$

Next, the linear-relation derivation section 34 triangulates a matrix M′_(R) by adding a constant multiple of an i-th row to an (i+1)-th row (i=1,2,3) to a seventh row to obtain the following matrix m.

            [EQ.  28] $m = \begin{pmatrix} 522 & 542 & 571 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 171 & 48 & 0 & 230 & 0 & 1 & 0 & 0 & 230 & 1 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 976 & 0 & 385 & 0 & 53 & 0 & 1 & 385 & 53 & 1 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 804 & 795 & 814 & 1 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 487 & 467 & 438 & 0 & 1 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 385 & 443 & 103 & 0 & 0 & 1 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 998 & 382 & 112 & 0 & 0 & 0 & 1 \end{pmatrix}$

As well known, the vector that is composed of a tenth component and afterward of a fourth row to a seventh row of the matrix m is a vector {(m_(1,1),m_(1,2), . . . ,m_(1,n)), (m_(2,1),m_(2,2), . . . , m_(2,n)), . . . } representing a linearly-independent linear dependence relation Σ_(i) ⁷m_(ji)v_(i)=0(j=1,2, . . . ) of all of the seven 12-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇ that were input. The linear-relation derivation section 34 outputs a vector m₁=(804,795,814,1,0,0,0) that is composed of the tenth component and afterward of the fourth row of the matrix m, a vector m₂=(487,467,438,0,1,0,0) that is composed of the tenth component and afterward of the fifth row of the matrix m, and a vector m₃=(385,443,103,0,0,1,0) that is composed of the tenth component and afterward of the sixth row of the matrix m, and a vector m₄=(998,382,112,0,0,0,1) that is composed of the tenth component and afterward of the seventh row of the matrix m.

Now return to the explanation of the process of the second ideal reduction section 13 in the basis construction section 33. Next, this ideal reduction section 13 makes a reference to the table for a Groebner basis construction of FIG. 11, retrieves a record, of which the value of the order field is said value d=3, and in which a vector of which the components that correspond to all component numbers described in the component number list field are all zero does not lie in said plurality of said vectors m₁=(804,795,814,1,0,0,0), m₂=(487,467,438,0,1,0,0), m₃=(385,443,103,0,0,1,0), and m₄=(998,382,112,0,0,0,1). The value of the order field of an eleventh record is 3, and a vector, of which the component number lists 4, 5, 6, and 7 of the eleventh record are all zero, does not lie in the vectors m₁, m₂, m₃, and m₄, whereby the eleventh record is obtained as a retrieval result.

Furthermore, the value of the first vector type of the eleventh record is (*,*,*,1,0,0,0) (A code * is interpreted as representing any number), which coincides with the vector m₁=(804,795,814,1,0,0,0), whereby the vector m₁ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, X², X³, Y, X⁴, and XY of the algebraic curve parameter file A to generate a polynomial f₁=804+795X+814X²+X³.

Similarly, the value of the second vector type of the eleventh record is (*,*,*,0,1,0,0) (A code * is interpreted as representing any number), which coincides with the vector m₂=(487,467,438,0,1,0,0), whereby the vector m₂ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, X², X³, Y, X⁴, and XY of the algebraic curve parameter file A to generate a polynomial f₂=487+467X+438X²+Y. The value of the third vector type of the eleventh record is null, whereby it is neglected.

Finally, the ideal reduction section 13 constructs a set J**={f₁,f₂}={804+795X+814X²+X³, 487+467X+438X²+Y} of the polynomial to output it. Above, the operation of the second ideal reduction section 13 is finished. Finally, in the Jacobian group adder of FIG. 1, the Groebner basis J**={804+795X+814X²+X³,487+467X+438X²+Y}, which the ideal reduction section 13 output, is output from the output apparatus.

Next, the embodiment of the case will be shown in which the C₂₅ curve was employed. In this embodiment, the algebraic curve parameter file of FIG. 12 is employed as an algebraic curve parameter file, the ideal type table of FIG. 13 as an ideal type table, the monomial list table of FIG. 14 as an monomial list table, and the table for a Groebner basis construction of FIG. 15 as a table for a Groebner basis construction respectively.

In the Jacobian group element adder of FIG. 1, suppose Groebner bases I ₁={729+88X+X ²,475+124X+Y} and I ₂={180+422X+X ²,989+423X+Y} were input of the ideal of the coordinate ring of the algebraic curve designated by the algebraic curve parameter file A, which represents an element of the Jacobian group of the C₂₅ curve designated by the algebraic curve parameter file A 16 and the algebraic curve parameter file A of FIG. 12.

At first, the ideal composition section 11, which takes the algebraic curve parameter file A of FIG. 12, and the above-mentioned Groebner bases I₁ and I₂ as an input, operates as follows according to a flow of the process of the functional block shown in FIG. 2. The ideal composition section 11 firstly makes a reference to the ideal type table of FIG. 13 in the ideal type classification section 21 of FIG. 2, retrieves a record in which the ideal type described in the ideal type field accords with the type of the input ideal I₁ for obtaining a sixth record, and acquires a value N₁=21 of the ideal type number field and a value d₁=2 of the order field of the sixth record. Similarly, the ideal composition section 11 retrieves a record in which the ideal type accords with the type of the input ideal I₂ for obtaining the sixth record, and acquires a value N₂=21 of the ideal type number field and a value d₂=2 of the order field of the sixth record.

Next, the ideal composition section 11 calculates the sum d₃=d₁+d₂=4 of said values d₁=2 and d₂=2 of said order field in the monomial vector generation section 22, makes a reference to the monomial list table of FIG. 14, retrieves a record of which the value of the order field is said d₃=4 for obtaining the first record, and acquires a list of the monomial 1, X, X², Y, X³, XY, and X⁴ described in the monomial list field of the first record. I₁ and I₂ are different, whereby a remainder to be attained by dividing M_(i) by I₁ for each of M_(i)(1<=i<=7) in said list 1, X, X², Y, X³, XY, and X⁴ of said monomial is calculated to obtained a polynomial a^((i)) ₁+a^((i)) ₂X, to arrange its coefficients in order of the monomial order 1, X, . . . of the algebraic curve parameter file A, and to generate a vector w^((i)) ₁=(a^((i)) ₁,a^((i)) ₂).

Furthermore, the ideal composition section 11 calculates a remainder to be attained by dividing M_(i) by I₂, obtains a polynomial b^((i)) ₁+b^((i)) ₂X, arranges its coefficients in order of the monomial order 1, X, . . . of the algebraic curve parameter file A, generates a vector w^((i)) ₂=(b^((i)) ₁,b^((i)) ₂), and connects the above-mentioned two vectors w^((i)) ₁ and w^((i)) ₂ for generating a vector v_(i)=(a^((i)) ₁,a^((i)) ₂,b^((i)) ₁,b^((i)) ₂). That is, divide M₁=1 by I₁: then 1=0·(729+88X+X²)+0·(475+124X+Y)+1, whereby 1 is obtained as a remainder to generate a vector w⁽¹⁾ ₁=(1,0). Furthermore, divide M₁=1 by I₂: then 1=0·(180+422X+X²)+0·(989+423X+Y)+1, whereby 1 is obtained as a remainder to generate a vector w⁽¹⁾ ₂=(1,0). w⁽¹⁾ ₁ and w⁽¹⁾ ₂ are connected to generate a vector v₁=(1,0,1,0).

Next, divide M₂=X by I₁: then X=0·(729+88X+X²)+0·(475+124X+Y)+X, whereby, X is obtained as a remainder to generate a vector w⁽²⁾ ₁=(0,1). Furthermore, divide M₂=X by I₂: then X=0·(180+422X+X²)+0·(989+423X+Y)+X, whereby X is obtained as a remainder to generate a vector w⁽²⁾ ₂=(0,1). w⁽²⁾ ₁ and w⁽²⁾ ₂ are connected to generate a vector v₂=(0,1,0,1).

Next, divide M₃=X² by I₁: then X²=1·(729+88X+X²)+0·(475+124X+Y)+280+921X, whereby, 280+921X is obtained as a remainder to generate a vector w⁽³⁾ ₁=(280,921). Furthermore, divide M₃=X² by I₂: then X²=1·(180+422X+X²)+0·(989+423X+Y)+829+587X, whereby 829+587X is obtained as a remainder to generate a vector w⁽³⁾ ₂=(829,587). w⁽³⁾ ₁ and w⁽³⁾ ₂ are connected to generate a vector v₃=(280,921,829,587).

Next, divide M₄=Y by I₁: then Y=0·(729+88X+X²)+1·(475+124X+Y)+534+885X, whereby 534+885X is obtained as a remainder to generate a vector w⁽⁴⁾ ₁=(534,885). Furthermore, divide M₄=Y by I₂: then Y=0·(180+422X+X²)+1·(989+423X+Y)+20+586X, whereby 20+586X is obtained as a remainder to generate a vector w⁽⁴⁾ ₂=(20,586). w⁽⁴⁾ ₁ and w⁽⁴⁾ ₂ are connected to generate a vector v₄=(534,885,20,586).

Next, divide M₅=X³ by I₁: then X³=(921+X)(729+88X+X²)+0·(475+124X+Y)+585+961X, whereby 585+961X is obtained as a remainder to generate a vector w⁽⁵⁾ ₁=(585,961).

Furthermore, divide M₅=X³ by I₂: then X³=(587+X)(180+422X+X²)+0·(989+423X+Y)+285+320X, whereby 285+320X is obtained as a remainder to generate a vector w⁽⁵⁾ ₂=(285,320). w⁽⁵⁾ ₁ and w⁽⁵⁾ ₂ are connected to generate a vector v₅=(585,961,285,320). Next, divide M₆=XY by I₁: then XY=885(729+88X+X²)+X·(475+124X+Y)+595+347X, whereby 595+347X is obtained as a remainder to generate a vector w⁽⁶⁾ ₁=(595,347).

Furthermore, divide M₆=XY by I₂: then XY=586(180+422X+X²)+X(989+423X+Y)+465+942X, whereby 465+942X is obtained as a remainder to generate a vector w⁽⁶⁾ ₂=(465,942). w⁽⁶⁾ ₁ and w⁽⁶⁾ ₂ are connected to generate a vector v₆=(595,347,465,942).

Finally, divide M₇=X⁴ by I₁: then X⁴=(961+921X+X²)(729+88X+X²)+0·(475+124X+Y)+686+773X, whereby, 686+773X is obtained as a remainder to generate a vector w⁽⁷⁾ ₁=(686,773). Furthermore, divide M₇=X⁴ by I₂: then X⁴=(320+587X+X²)(180+422X+X²)+0·(989+423X+Y)+922+451X, whereby 922+451X is obtained as a remainder to generate a vector w⁽⁷⁾ ₂=(922,451). w⁽⁷⁾ ₁ and w⁽⁷⁾ ₂ are connected to generate a vector v₇=(686,773,922,451). Above, the process of the ideal composition section 11 in the monomial vector generation section 22 is finished.

Next, in the basis construction section 23, the ideal composition section 11 inputs seven four-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇ generated in the monomial vector generation section 22 into the linear-relation derivation section 24, and obtains a plurality of seven-dimensional vectors m₁, m₂, . . . as an output. The linear-relation derivation section 24 derives a linear relation of the vectors, which were input, employing the discharging method. The discharging method belongs to a known art, whereby, as to the operation of the linear-relation derivation section 24, only its outline is shown below. The linear-relation derivation section 24 firstly arranges the seven four-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇, which were input, in order for constructing a 7×4 matrix

$\begin{matrix} {M_{C} = \begin{pmatrix} 1 & 0 & 1 & 0 \\ 0 & 1 & 0 & 1 \\ 280 & 921 & 829 & 587 \\ 534 & 885 & 20 & 586 \\ 585 & 961 & 285 & 320 \\ 595 & 347 & 465 & 942 \\ 686 & 773 & 922 & 451 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 29} \right\rbrack \end{matrix}$

Next, the linear-relation derivation section 24 connects a seven-dimensional unity matrix to the matrix M_(C) to obtain

$\begin{matrix} {M_{C}^{\prime} = \begin{pmatrix} 1 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 1 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\ 280 & 921 & 829 & 587 & 0 & 0 & 1 & 0 & 0 & 0 & 0 \\ 534 & 885 & 20 & 586 & 0 & 0 & 0 & 1 & 0 & 0 & 0 \\ 585 & 961 & 285 & 320 & 0 & 0 & 0 & 0 & 1 & 0 & 0 \\ 595 & 347 & 465 & 942 & 0 & 0 & 0 & 0 & 0 & 1 & 0 \\ 686 & 773 & 922 & 451 & 0 & 0 & 0 & 0 & 0 & 0 & 1 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 30} \right\rbrack \end{matrix}$

Next, the linear-relation derivation section 24 triangulates a matrix M′_(C) by adding a constant multiple of an i-th row to an (i+1)-th row (i=1,2, . . . ,4) to a seventh row to obtain the following a matrix m.

$\begin{matrix} {m = \begin{pmatrix} 1 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 & 0 \\ 0 & 1 & 0 & 1 & 0 & 1 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 549 & 675 & 729 & 88 & 1 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 548 & 744 & 789 & 363 & 1 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 444 & 709 & 900 & 42 & 1 & 0 & 0 \\ 0 & 0 & 0 & 0 & 969 & 716 & 940 & 619 & 0 & 1 & 0 \\ 0 & 0 & 0 & 0 & 635 & 230 & 807 & 778 & 0 & 0 & 1 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 31} \right\rbrack \end{matrix}$

As well known, the vector that is composed of a fifth component and afterward of a fifth row to a seventh row of the matrix m is a vector {(m_(1,1),m_(1,2), . . . ,m_(1,7)), (m_(2,1),m_(2,2), . . . ,m_(2,7)), . . . } representing a linearly-independent linear dependence relation Σ_(i=1) ⁷m_(ji)v_(i)=0(j=1,2, . . . ) of all of the seven four-dimensional vectors v₁, v₂, v₃, v₄, v₅, v₆, and v₇ that were input.

The linear-relation derivation section 24 outputs a vector m₁=(444,709,900,42,1,0,0) that is composed of the fifth component and afterward of the fifth row of the matrix m, a vector m₂=(969,716,940,619,0,1,0) that is composed of the fifth component and afterward of the sixth row of the matrix m, and a vector m₃=(635,230,807,778,0,0,1) that is composed of the fifth component and afterward of the seventh row of the matrix m.

Now return to the explanation of the process of the ideal composition section 11 in the basis construction section 23. Next, the ideal composition section 11 makes a reference to the table for a Groebner basis construction of FIG. 15, retrieves a record, of which the value of the order field is said value d₃=4, and in which a vector of which the components that correspond to all component numbers described in the component number list field are all zero does not lie in said plurality of said vectors m₁=(444,709,900,42,1,0,0), m₂=(969,716,940,619,0,1,0), and m₃=(635,230,807,778,0,0,1). The value of the order field of a first record is 4, and a vector, of which the components that correspond to the component number lists, 5, 6, and 7 of the first record are all zero, does not lie in the vectors m₁, m₂, and m₃, whereby the first record is obtained as a retrieval result.

Furthermore, the value of the first vector type of the first record is (*,*,*,*,1,0,0)(A code * is interpreted as representing any number), which coincides with the vector m₁=(444,709,900,42,1,0,0), whereby the vector m₁ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, X², Y, X³, XY, and X⁴ of the algebraic curve parameter file A to generate a polynomial f₁=444+709X+900X²+42Y+X³.

Similarly, the value of the second vector type of the first record is (*,*,*,*,0,1,0)(A code * is interpreted as representing any number), which coincides with the vector m₂=(969,716,940,619,0,1,0), whereby the vector m₂ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, X², Y, X³, XY, and X⁴ of the algebraic curve parameter file A to generate a polynomial f₂=969+716X+940X²+619Y+XY. The value of the third vector type of the first record is null, whereby it is neglected. Finally, the ideal composition section 11 constructs a set J={f_(1,f) ₂}={444+709X+900X²+42Y+X³,969+716X+940X²+619Y+XY} of the polynomial to output it. Above, the operation of the ideal composition section 11 is finished.

Next, the first ideal reduction section 12, which takes as an input the algebraic curve parameter file A of FIG. 12, and the Groebner bases J={444+709X+900X²+42Y+X³,969+716X+940X²+619Y+XY} that the ideal composition section 11 output, operates as follows according to a flow of the process of the functional block shown in FIG. 3. At first, the first ideal reduction section 12 makes a reference to the ideal type table of FIG. 12 in the ideal type classification section 31 of FIG. 3, retrieves a record in which the ideal type described in the ideal type field accords with the type of the input ideal J for obtaining a first record, and acquires a value N=41 of the ideal type number field and a value d=2 of the reduction order field of the first record.

Next, the ideal reduction section 12 confirms that said value d=2 is not zero, makes a reference to the monomial list table of FIG. 14 in the polynomial vector generation section 32, retrieves a record of which the value of the order field is said d=2 for obtaining a third record, and acquires a list 1, X, X², and Y of the monomial described in the monomial list field of the third record. Furthermore, the ideal reduction section 12 acquires a first element f=444+709X+900X²+42Y+X³, and a second element g=969+716X+940X²+619Y+XY of J (A third element does not lie in J, whereby a third polynomial h is not employed), regards a coefficient list 0, 7, 0, 0, 0, 0, 0, 0, 1, and 1 of the algebraic curve parameter file A as a column of the coefficient of each monomial of the monomial order 1, X, X², Y, X³, XY, X⁴, X²Y, X⁵, and Y² of the algebraic curve parameter file A, and generates a defining polynomial F=Y²+X⁵+7X.

Next, for each of M_(i)(1<=i<=4) in said list 1, X, X², and Y of said monomial, the ideal reduction section 12 calculates a remainder equation r_(i) of a product Mi·g of M_(i) and the polynomial g by the polynomials f and F, arranges its coefficients in order of the monomial order 1, X, X², Y, X³, XY, X⁴, and X²Y of the algebraic curve parameter file A, and generates a vector v_(i). That is, at first, for a first monomial M₁=1, divide 1·g=969+716X+940X²+619Y+XY by f=444+709X+900X²+42Y+X³ and F=Y²+X⁵+7X: then g=0·f+0·F+969+716X+940X²+619Y+XY, whereby a remainder 969+716X+940X²+619Y+XY is obtained to generate a vector v₁=(969,716,940,619,0,1,0,0).

Next, a second monomial M₂=X, divide Xg=X(969+716X+940X²+619Y+XY) by f=444+709X+900X²+42Y+X³ and F=Y²+X⁵+7X: then Xg=940f+0·F+366+449X+258X²+880Y+619XY+X²Y, whereby a remainder 366+449X+258X²+880Y+619XY+X²Y is obtained to generate a vector v₂=(366,449,258,880,0,619,0,1).

Next, a third monomial M₃=X², divide X²g=X²(969+716X+940X²+619Y+XY) by f=444+709X+900X²+42Y+X³ and F=Y²+X⁵+7X: then X²g=(297+473X+42X²+Y) f+967F+311+462X+199X²+199Y+614XY+982X²Y, whereby a remainder 311+462X+199X²+199Y+614XY+982X²Y is obtained to generate a vector v₃=(311,462,199,199,0,614,0,982).

Finally, a fourth monomial M₄=Y, divide Yg=Y(969+716X+940X²+619Y+XY) by f=444+709X+900X²+42Y+X³ and F=Y²+X⁵+7X: then Yg=(994+625X+27X²+1008X³+42Y)f+(873+X)F+606+463X+322X²+104Y+183XY+348X²Y, whereby a remainder 606+463X+322X²+104Y+183XY+348X²Y is obtained to generate a vector v₄=(606,463,322,104,0,183,0,348). Above, the process of the ideal reduction section 12 in the polynomial vector generation section 32 is finished.

Next, in the basis construction section 33, the first ideal reduction section 12 inputs four eight-dimensional vectors v₁, v₂, v₃, and v₄ generated in the polynomial vector generation section 32 into the linear-relation derivation section 34, and obtains a plurality of four-dimensional vectors m₁, m₂, . . . as an output. The linear-relation derivation section 34 derives a linear relation of the vectors, which were input, employing the discharging method. The discharging method belongs to a known art, whereby, as to the operation of the linear-relation derivation section 34, only its outline is shown below.

The linear-relation derivation section 34 firstly arranges the four eight-dimensional vectors v₁, v₂, v₃, and, v₄, which were input, in order for constructing a 4×8 matrix

$\begin{matrix} {M_{R} = \begin{pmatrix} 969 & 716 & 940 & 619 & 0 & 1 & 0 & 0 \\ 366 & 449 & 258 & 880 & 0 & 619 & 0 & 1 \\ 311 & 462 & 199 & 199 & 0 & 614 & 0 & 982 \\ 606 & 463 & 322 & 104 & 0 & 183 & 0 & 348 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 32} \right\rbrack \end{matrix}$

Next, the linear-relation derivation section 34 connects a four-dimensional unity matrix to the matrix M_(R) to construct

$\begin{matrix} {M_{R}^{\prime} = \begin{pmatrix} 969 & 716 & 940 & 619 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 \\ 366 & 449 & 258 & 880 & 0 & 619 & 0 & 1 & 0 & 1 & 0 & 0 \\ 311 & 462 & 199 & 199 & 0 & 614 & 0 & 982 & 0 & 0 & 1 & 0 \\ 606 & 463 & 322 & 104 & 0 & 183 & 0 & 348 & 0 & 0 & 0 & 1 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 33} \right\rbrack \end{matrix}$

Next, the linear-relation derivation section 34 triangulates a matrix M′_(R) by adding a constant multiple of an i-th row to an (i+1)-th row (i=1,2) to a fourth row to obtain the following matrix m.

$\begin{matrix} {m = \begin{pmatrix} 969 & 716 & 940 & 619 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 \\ 0 & 341 & 787 & 848 & 0 & 275 & 0 & 1 & 665 & 1 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 835 & 27 & 1 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 312 & 661 & 0 & 1 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 34} \right\rbrack \end{matrix}$

As well known, the vector that is composed of a ninth component and afterward of a third row and a fourth row of the matrix m is a vector {(m_(1,1),m_(1,2), . . . ,m_(1,4)), (m_(2,1),m_(2,2), . . . ,m_(2,4)),. . . } representing a linearly-independent linear dependence relation Σ_(i=1) ⁴m_(ji)v_(i)=0(j=1,2, . . . ) of all of the four eight-dimensional vectors v₁, v₂, v₃, and v₄ that were input. The linear-relation derivation section 34 outputs a vector m₁=(835,27,1,0) that is composed of the ninth component and afterward of the third row of the matrix m, and a vector m₂=(312,661,0,1) that is composed of the ninth component and afterward of the fourth row of the matrix m.

Now return to the explanation of the process of the first ideal reduction section 12 in the basis construction section 33. Next, the ideal reduction section 12 makes a reference to the table for a Groebner basis construction of FIG. 15, and retrieves a record, of which the value of the order field is said value d=2, and in which a vector of which the components that correspond to all component numbers described in the component number list field are all zero does not lie in said plurality of said vectors m₁=(835,27,1,0), and m₂=(312,661,0,1). The value of the order field of a sixth record is 2, and a vector, of which the components that correspond to the component number lists 3 and 4 of the sixth record are all zero, does not lie in the vectors m₁ and m₂, whereby the sixth record is obtained as a retrieval result.

Furthermore, the value of the first vector type of the sixth record is (*,*,1,0)(A code * is interpreted as representing any number), which coincides with the vector m₁=(835,27,1,0), whereby the vector m₁ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, X², and Y of the algebraic curve parameter file A to generate a polynomial f₁=835+27X+X². Similarly, the value of the second vector type of the sixth record is (*,*,0,1)(A code * is interpreted as representing any number), which coincides with the vector m₂=(312,661,0,1), whereby the vector m₂ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, X^(2,)and Y of the algebraic curve parameter file A to generate a polynomial f₂=312+661X+Y. The value of the third vector type of the sixth record is null, whereby it is neglected. Finally, the ideal reduction section 12 constructs a set J*={f₁,f₂}={835+27X+X²,312+661X+Y} of the polynomial to output it. Above, the operation of the first ideal reduction section 12 is finished.

Next, the second ideal reduction section 13, which takes as an input the algebraic curve parameter file A of FIG. 12, and the Groebner basis J*={f₁,f₂}={835+27X+X²,312+661X+Y} that the first ideal reduction section 12 output, operates as follows according to a flow of the process of the functional block shown in FIG. 3. At first, the second ideal reduction section 13 makes a reference to the ideal type table of FIG. 13 in the ideal type classification section 31 of FIG. 3, retrieves a record in which the ideal type described in the ideal type field accords with the type of the input ideal J* for obtaining a sixth record, and acquires a value N=21 of the ideal type number field and a value d=2 of the reduction order field of the sixth record.

Next, the ideal reduction section 13 confirms that said value d=2 is not zero, makes a reference to the monomial list table of FIG. 14 in the polynomial vector generation section 32, retrieves a record of which the value of the order field is said d=2 for obtaining a third record, and acquires a list 1, X, X², and Y of the monomial described in the monomial list field of the third record. Furthermore, the ideal reduction section 13 acquires a first element f=835+27X+X², and a second element g=312+661X+Y of J* (A third element does not lie in J*, whereby a third polynomial h is not employed), regards a coefficient list 0, 7, 0, 0, 0, 0, 0, 0, 1, and 1 of the algebraic curve parameter file A as a column of the coefficient of each monomial of the monomial order 1, X, X², Y, X³, XY, X⁴, X²Y, X⁵, and Y² of the algebraic curve parameter file A, and generates a defining polynomial F=Y²+X⁵+7X.

Next, for each of M_(i)(1<=i<=4) in said list 1, X, X² and Y of said monomial, the ideal reduction section 13 calculates a remainder equation r_(i) of a product Mi·g of M_(i) and the polynomial g by the polynomials f and F, arranges its coefficients in order of the monomial order 1, X, X², Y, X³, XY, X⁴, and X²Y of the algebraic curve parameter file A, and generates a vector v_(i). That is, at first, for a first monomial M₁=1, divide 1·g=312+661X+Y by f=835+27X+X² and F=Y²+X⁵+7X: then g=0·f+0·F+312+661X+Y, whereby a remainder 312+661X+Y is obtained to generate a vector v₁=(312,661,0,1,0,0).

Next, a second monomial M₂=X, divide Xg=X(312+661X+Y) by f=835+27X+X² and F=Y²+X⁵+7X: then Xg=661f+0·F+997+627X+XY, whereby a remainder 997+627X+XY is obtained to generate a vector v₂=(997,627,0,0,0,1). Next, a third monomial M₃=X², divide X²g=X²(312+661X+Y) by f=835+27X+X² and F=Y²+X⁵+7X: then X²g=(627+661X+Y)f+0·F+126+212X+174Y+982XY, whereby a remainder 126+212X+174Y+982XY is obtained to generate a vector v₃=(126,212,0,174,0,982).

Finally, a fourth monomial M₄=Y, divide Yg=Y(312+661X+Y) by f=835+27X+X² and F=Y²+X⁵+7X: then Yg=(827+106X+27X²+1008X³)f+1·F+620+144X+312Y+661XY, whereby a remainder 620+144X+312Y+661XY is obtained to generate a vector v₄=(620,144,0,312,0,661). Above, the process of the second ideal reduction section 13 in the polynomial vector generation section 32 is finished.

Next, in the basis construction section 33, this second ideal reduction section 13 inputs four six-dimensional vectors v₁, v₂, v₃, and v₄ generated in the polynomial vector generation section 32 into the linear-relation derivation section 34, and obtains a plurality of four-dimensional vectors m₁, m₂, . . . as an output. The linear-relation derivation section 34 derives a linear relation of the vectors, which were input, employing the discharging method. The discharging method belongs to a known art, whereby, as to the operation of the linear-relation derivation section 34, only its outline is shown below.

The linear-relation derivation section 34 firstly arranges the four six-dimensional vectors v₁, v₂, v₃, and, v₄, which were input, in order for constructing a 4×6 matrix

$\begin{matrix} {M_{R} = \begin{pmatrix} 312 & 661 & 0 & 1 & 0 & 0 \\ 997 & 627 & 0 & 0 & 0 & 1 \\ 126 & 212 & 0 & 174 & 0 & 982 \\ 620 & 144 & 0 & 312 & 0 & 661 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 35} \right\rbrack \end{matrix}$

Next, the linear-relation derivation section 34 connects a four-dimensional unity matrix to the matrix M_(R) to construct

$\begin{matrix} {M_{R}^{\prime} = \begin{pmatrix} 312 & 661 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 \\ 997 & 627 & 0 & 0 & 0 & 1 & 0 & 1 & 0 & 0 \\ 126 & 212 & 0 & 174 & 0 & 982 & 0 & 0 & 1 & 0 \\ 620 & 144 & 0 & 312 & 0 & 661 & 0 & 0 & 0 & 1 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 36} \right\rbrack \end{matrix}$

Next, the linear-relation derivation section 34 triangulates a matrix M′_(R) by adding a constant multiple of an i-th row to an (i+1)-th row (i=1,2) to a fourth row to obtain the following matrix m.

$\begin{matrix} {m = \begin{pmatrix} 312 & 661 & 0 & 1 & 0 & 0 & 1 & 0 & 0 & 0 \\ 0 & 536 & 0 & 815 & 0 & 1 & 815 & 1 & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 835 & 27 & 1 & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & 697 & 348 & 0 & 1 \end{pmatrix}} & \left\lbrack {{EQ}.\mspace{14mu} 37} \right\rbrack \end{matrix}$

As well known, the vector that is composed of a seventh component and afterward of a third row and a fourth row of the matrix m is a vector {(m_(1,1),m_(1,2), . . . ,m_(1,4)), (m_(2,1),m_(2,2), . . . ,m_(2,4)), . . . } representing a linearly-independent linear dependence relation Σ_(i=1) ⁴m_(ji)v_(i)=0(j=1,2, . . . ) of all of the four six-dimensional vectors v₁, v₂, v₃, and v₄ that were input.

The linear-relation derivation section 34 outputs a vector m₁=(835,27,1,0) that is composed of the seventh component and afterward of the third row of the matrix m, and a vector m₂=(697,348,0,1) that is composed of the seventh component and afterward of the fourth row of the matrix m. Now return to the explanation of the process of the ideal reduction section 13 in the basis construction section 33. Next, the ideal reduction section 13 makes a reference to the table for a Groebner basis construction of FIG. 15, retrieves a record, of which the value of the order field is said value d=2, and in which a vector of which the components that correspond to all component numbers described in the component number list field are all zero does not lie in said plurality of said vectors m₁=(835,27,1,0), and m₂=(697,348,0,1). The value of the order field of a sixth record is 2, and a vector, of which the component number lists 3 and 4 of the sixth record are all zero, does not lie in the vectors m₁, and m₂, whereby the sixth record is obtained as a retrieval result.

Furthermore, the value of the first vector type of the sixth record is (*,*,1,0)(A code * is interpreted as representing any number), which coincides with the vector m₁=(835,27,1,0), whereby the vector m₁ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, X², and Y of the algebraic curve parameter file A to generate a polynomial f₁=835+27X+X². Similarly, the value of the second vector type of the sixth record is (*,*,0,1)(A code * is interpreted as representing any number), which coincides with the vector m₂=(697,348,0,1), whereby the vector m₂ is regarded as a column of the coefficient of each monomial of the monomial order 1, X, X²,and Y of the algebraic curve parameter file A to generate a polynomial f₂=697+348X+Y. The value of the third vector type of the sixth record is null, whereby it is neglected. Finally, the ideal reduction section 13 constructs a set J**={f₁,f₂}={835+27X+X²,697+348X+Y} of the polynomial to output it. Above, the operation of the ideal reduction section 13 is finished. Finally, in the Jacobian group adder of FIG. 1, the Groebner basis J**={835+27X+X²,697+348X+Y}, which the second ideal reduction section 13 output, is output from the output apparatus.

The effect exists: employment of the present invention allows the addition in the Jacobian group of the C_(ab) curve to be calculated at a high speed, and practicality of the C_(ab) curve to be enhanced.

The present invention has been described with reference to the preferred embodiments. However, it will be appreciated by those skilled in the relevant field that a number of other embodiments, differing from those specifically described, will also fall within the spirit and scope of the present invention. Accordingly, it will be understood that the invention is not intended to be limited to the embodiments described in the specification. The scope of the invention is only limited by attached claims.

The entire disclosure of Japanese Patent Application No. 2002-240034 filed on Aug. 21, 2002 including specification, claims, drawing and summary are incorporated herein by reference in its entirety. 

1. A Jacobian group element adder, which is an arithmetic unit for executing addition in a Jacobian group of an algebraic curve defined by a polynomial defined over a finite field that is Y³+α₀X⁴+α₁XY²+α₂X²Y+α₃X³+α₄Y²+α₅XY+α₆X²+α₇Y+α₈X+α₉ or Y²+α₀X⁵+α₁X²Y+α₂X⁴+α₃XY+α₄X³+α₅Y+α₆X²+α₇X+α₈ or Y²+α₀X⁷+α₁X³Y+α₂X⁶+α₃X²Y+α₄X⁵+α₅XY+α₆X⁴+α₇Y+α₈X³+α₉X²+α₁₀X+α₁₁, said Jacobian group element adder comprising: means for inputting an algebraic curve parameter file having an order of a field of definition, a monomial order, and a coefficient list described as a parameter representing said algebraic curve; means for inputting Groebner bases I₁ and I₂ of ideals of the coordinate ring of the algebraic curve designated by said algebraic curve parameter file, said Groebner bases representing elements of said Jacobian group; ideal reduction means for, in the coordinate ring of the algebraic curve designated by said algebraic curve parameter file, performing arithmetic of producing a Groebner basis J of the ideal which is a product of the ideal that the Groebner basis I₁ generates, and the ideal that the Groebner basis I₂ generates; first ideal reduction means for, in the coordinate ring of the algebraic curve designated by said algebraic curve parameter file, performing arithmetic of producing a Groebner basis J* of the ideal, which is smallest in the monomial order designated by said algebraic curve parameter file among the ideals equivalent to an inverse ideal of the ideal that the Groebner basis J generates; and second ideal reduction means for, in the coordinate ring of the algebraic curve designated by said algebraic curve parameter file, performing arithmetic of producing a Groebner basis J** of the ideal, which is smallest in the monomial order designated by said algebraic curve parameter file among the ideals equivalent to an inverse ideal of the ideal that the Groebner basis J* generates, to output it.
 2. The Jacobian group element adder according to claim 1, wherein said ideal composition means has: linear-relation derivation means for, for a plurality of vectors v₁, v₂, . . . , and v_(n) that were input, outputting a plurality of vectors {m₁=(m_(1,1),m_(1,2), . . . ,m_(1,n)),m₂=(m_(2,1),m_(2,2), . . . ,m_(2,n)), . . . } representing linear dependence relations Σ_(i)m_(j,i)v_(i)=0(j=1,2, . . . ) of all of them employing a discharging method; an ideal type table that is composed of a record number field, an ideal type number field, an order field, and an ideal type field; a monomial list table that is composed of the record number field, the order field, and a monomial list field; a table for a Groebner basis construction that is composed of the record number field, the order field, a component number list field, a first vector type field, a second vector type field, and a third vector type field; ideal type classification means for acquiring said algebraic curve parameter file to make a reference to said ideal type table for each of Groebner bases I₁ and I₂ that were input, to retrieve a record in which the ideal type described in the ideal type field accords with the type of an input ideal I_(i)(i=1,2), and to acquire a value N_(i) of the ideal type number field and a value d_(i) of the order field of the retrieved record; monomial vector generation means for calculating a sum d₃=d₁+d₂ of said values d₁ and d₂ of said order field to make a reference to said monomial list table for retrieving a record R of which a value of the order field is said d₃, to acquire a list M₁, M₂, . . . of the monomial described in said monomial list field of said record R, when I₁ and I₂ are different, to calculate a remainder equation r₁ of dividing each said monomial M_(i) by I₁, to generate a vector w^((i)) ₁ that is composed of coefficients of the remainder equation r_(i) according to the monomial order described in said algebraic curve parameter file, furthermore to calculate a remainder equation s_(i) of dividing M_(i) by I₂, to generate a vector w^((i)) ₂ that is composed of coefficients of the remainder equation s_(i) according to the monomial order described in an algebraic curve parameter file A, to connect the above-mentioned two vectors w^((i)) ₁ and w^((i)) ₂ for generating a vector v_(i), also, when I₁ and I₂ are equal, to calculate a remainder equation r_(i) of dividing each said monomial M_(i) by I₁, to generate a vector w^((i)) ₁ that is composed of coefficients of the remainder equation r_(i) according to the monomial order described in said algebraic curve parameter file, furthermore to construct a defining polynomial F employing the coefficient list and the monomial order described in said algebraic curve parameter file, when a differential of a polynomial M with regard to by its X is expressed by D_(X)(M), and a differential of the polynomial M with regard to by its Y is expressed by D_(Y)(M), to calculate a remainder equation s_(i) of dividing a polynomial D_(X)(M_(i))D_(Y)(F)−D_(Y)(M_(i))D_(X)(F) by I₁, to generate a vector w^((i)) ₂ that is composed of coefficients of the remainder equation s_(i) according to the monomial order described in said algebraic curve parameter file, and to connect the above-mentioned two vectors w^((i)) ₁ and w^((i)) ₂ for generating a vector v_(i); and basis construction means for inputting said plurality of said vectors v₁, v₂, . . . into said linear-relation derivation means, to acquire a plurality of vectors m₁, m₂, . . . as an output, to make an reference to said table for a Groebner basis construction for retrieving a record R₂, of which a value of the order field is said value d₃, and in which a vector of which the components that correspond to all component numbers described in the component number list field are all zero does not lie in said plurality of said vectors m₁, m₂, . . . , to select a vector m that accords with a first vector type of said record R₂ from among said plurality of said vectors m₁, m₂, . . . , to generate a polynomial f₁ of which the coefficient is a value of a component of the vector m according to the monomial order described in said algebraic curve parameter file, hereinafter, similarly, to generate a polynomial f₂ employing a vector that accords with a second vector type, and also a polynomial f₃ employing a vector that accords with a third vector type, to obtain a set J={f₁,f₂,f₃} of the polynomial, and to output it as said Groebner basis J.
 3. The Jacobian group element adder according to one of claim 1 and claim 2, wherein each of said first and said second ideal reduction means has: linear-relation derivation means for, for a plurality of vectors v₁, v₂, . . . , and v_(n) that were input, outputting a plurality of vectors {m₁=(m_(1,1),m_(1,2), . . . ,m_(1,n)),m₂=(m_(2,1),m_(2,2), . . . ,m_(2,n)), . . . } representing linear dependence relations Σ_(i)m_(j,i)v_(i)=0(j=1,2, . . . ) of all of them employing a discharging method; an ideal type table that is composed of the record number field, the ideal type number field, a reduction order field, and the ideal type field; a monomial list table that is composed of the record number field, the order field, and the monomial list field; a table for a Groebner basis construction that is composed of the record number field, the order field, the component number list field, the first vector type field, the second vector type field, and the third vector type field; ideal type classification means for acquiring said algebraic curve parameter file to make a reference to said ideal type table, to retrieve a record in which the ideal type described in the ideal type field accords with the type of an input ideal J, to acquires a value N of the ideal type number field and a value d of the reduction order field of the retrieved record; polynomial vector generation means for, when said d is zero, outputting the input ideal J as said Groebner basis J*, when said d is not zero, to make a reference to said monomial list table for retrieving a record R of which a value of the order field is said d, to acquire a list M₁, M₂, . . . of the monomial described in the monomial list field of said record R, to construct a defining polynomial F employing the coefficient list and the monomial order described in said algebraic curve parameter file, to acquire a first polynomial f, a second polynomial g, and a third polynomial h of the input ideal J, to calculate a remainder equation r_(i) of a product M_(i)·g of each said monomial M_(i) and the polynomial g by the polynomials f and F, to generate a vector w^((i)) ₁ that is composed of coefficients of the remainder equation r_(i) according to the monomial order described in said algebraic curve parameter file, furthermore to calculate a remainder equation s_(i) of a product M_(i)·h of each said monomial M_(i) and the polynomial h by the polynomials f and F, to generate a vector w^((i)) ₂ that is composed of coefficients of the remainder equation s_(i) according to the monomial order described in said algebraic curve parameter file, and to connect the above-mentioned two vectors w^((i)) ₁ and w^((i)) ₂ for generating a vector v_(i); and basis construction means for inputting said plurality of said vectors v₁, v₂, . . . into said linear-relation derivation means, to obtain a plurality of vectors m₁, m₂, . . . as an output, to make a reference to said table for a Groebner basis construction for retrieving a record R₂ of which a value of the order field is said value d, and in which a vector of which the components that correspond to all component numbers described in the component number list field are all zero does not lie in said plurality of said vectors m₁, m₂, . . . , to select a vector m that accords with a first vector type of said record R₂ from among said plurality of said vectors m₁, m₂, . . . , to generate a polynomial f₁ of which a coefficient is a value of the component of the vector m according to the monomial order described in said algebraic curve parameter file, hereinafter, similarly, to generate a polynomial f₂ employing the vector that accords with a second vector type, and also a polynomial f₃ employing the vector that accords with a third vector type, to obtain a set {f₁,f₂,f₃} of the polynomial, and to output it as said Groebner basis J* or J**.
 4. A record medium having a program recorded for causing an information processing unit configuring an arithmetic unit for executing addition in a Jacobian group of an algebraic curve defined by a polynomial defined over a finite field that is Y³+α₀X⁴+α₁XY²+α₂X²Y+α₃X³+α₄Y²+α₅XY+α₆X²+α₇Y+α₈X+α₉ or Y²+α₀X⁵+α₁X²Y+α₂X⁴+α₃XY+α₄X³+α₅Y+α₆X²+α₇X+α₈ or Y²+α₀X⁷+α₁X³Y+α₂X⁶+α₃X²Y+α₄X⁵+α₅XY+α₆X⁴+α₇Y+α₈X³+α₉X²+α₁₀X+α₁₁ to perform: a process of inputting an algebraic curve parameter file having an order of a field of definition, a monomial order, and a coefficient list described as a parameter representing said algebraic curve; a process of inputting Groebner bases I₁ and I₂ of ideals of the coordinate ring of the algebraic curve designated by said algebraic curve parameter file, said Groebner bases representing an element of said Jacobian group; an ideal composition process of, in the coordinate ring of the algebraic curve designated by said algebraic curve parameter file, performing arithmetic of producing a Groebner basis J of an ideal which is a product of the ideal that the Groebner basis I₁ generates, and an ideal that the Groebner basis I₂ generates; a first ideal reduction process of, in the coordinate ring of the algebraic curve designated by said algebraic curve parameter file, performing arithmetic of producing a Groebner basis J* of the ideal, which is smallest in the monomial order designated by said algebraic curve parameter file among the ideals equivalent to an inverse ideal of the ideal that the Groebner basis J generates; and a second ideal reduction process of, in the coordinate ring of the algebraic curve designated by said algebraic curve parameter file, performing arithmetic of producing a Groebner basis J** of the ideal, which is smallest in the monomial order designated by said algebraic curve parameter file among the ideals equivalent to an inverse ideal of the ideal that the Groebner basis J* generates, to output it, said record medium being readable by said information processing unit.
 5. The record medium according to claim 4, said record medium having a program recorded for causing said information processing unit to further perform in said ideal composition process: a linear-relation derivation process of, for a plurality of vectors v₁, v₂, . . . , and v_(n) that were input, outputting a plurality of vectors {m₁=(m_(1,1),m_(2,1), . . . ,m_(1,n)),m₂=(m_(2,1),m_(2,2), . . . ,m_(2,n)), . . . } representing linear dependence relations Σ_(i)m_(j,i)v_(i)=0(j=1,2, . . . ) of all of them employing a discharging method; an ideal type classification process of acquiring said algebraic curve parameter file to make a reference to an ideal type table, which is composed of a record number field, an ideal type number field, an order field, and an ideal type field, for each of Groebner bases I₁ and I₂ that were input, to retrieve a record in which the ideal type described in the ideal type field accords with the type of an input ideal I_(i)(i=1,2), and to acquire a value N_(i) of the ideal type number field and a value d_(i) of the order field of the retrieved record; a monomial vector generation process of calculating a sum d₃=d₁+d₂ of said values d₁ and d₂ of said order field to make a reference to a monomial list table, which is composed of the record number field, the order field, and a monomial list field, for retrieving a record R of which a value of the order field is said d₃, to acquire a list M₁, M₂, . . . of the monomial described in said monomial list field of said record R, when I₁ and I₂ are different, to calculate a remainder equation r_(i) of dividing each said monomial M_(i) by I₁, to generate a vector w^((i)) ₁ that is composed of coefficients of the remainder equation r_(i) according to the monomial order described in said algebraic curve parameter file, furthermore to calculate a remainder equation s_(i) of dividing M_(i) by I₂, to generate a vector w^((i)) ₂ that is composed of coefficients of the remainder equation s_(i) according to the monomial order described in an algebraic curve parameter file A, to connect the above-mentioned two vectors w^((i)) ₁ and w^((i)) ₂ for generating a vector v_(i), also, when I₁ and I₂ are equal, to calculate a remainder equation r_(i) of dividing each said monomial M_(i) by I₁, to generate a vector w^((i)) ₁ that is composed of coefficients of the remainder equation r_(i) according to the monomial order described in said algebraic curve parameter file, furthermore to construct a defining polynomial F employing the coefficient list and the monomial order described in said algebraic curve parameter file, when a differential of a polynomial M with regard to by its X is expressed by D_(X)(M), and a differential of the polynomial M with regard to by its Y is expressed by D_(Y)(M), to calculate a remainder equation s_(i) of dividing a polynomial D_(X)(M_(i))D_(Y)(F)−D_(Y)(M_(i))D_(X)(F) by I₁, to generate a vector w^((i)) ₂ that is composed of coefficients of the remainder equation s_(i) according to the monomial order described in said algebraic curve parameter file, and to connect the above-mentioned two vectors w^((i)) ₁ and w^((i)) ₂ for generating a vector v_(i); and a basis construction process of obtaining a plurality of vectors m₁, m₂, . . . output in said linear-relation derivation process, to make an reference to a table for a Groebner basis construction, which is composed of the record number field, the order field, a component number list field, a first vector type field, a second vector type field, and a third vector type field, for retrieving a record R₂, of which a value of the order field is said value d₃, and in which a vector of which the components that correspond to all component numbers described in the component number list field are all zero does not lie in said plurality of said vectors m₁, m₂, . . . , to select a vector m that accords with a first vector type of said record R₂ from among said plurality of said vectors m₁, m₂, . . . , to generate a polynomial f₁ of which the coefficient is a value of a component of the vector m according to the monomial order described in said algebraic curve parameter file, hereinafter, similarly, to generate a polynomial f₂ employing a vector that accords with a second vector type, and also a polynomial f₃ employing a vector that accords with a third vector type, to obtain a set J={f₁,f₂,f₃} of the polynomial, and to output it as said Groebner basis J.
 6. The record medium according to one of claim 4 and claim 5, said record medium having a program recorded for causing said information processing to further perform in each of said first and second ideal reduction processes: a linear-relation derivation process of, for a plurality of vectors v₁, v₂, . . . , and v_(n) that were input, outputting a plurality of vectors {m₁=(m_(1,1),m_(1,2), . . . ,m_(1,n)),m₂=(m_(2,1),m_(2,2), . . . ,m_(2,n)), . . . } representing linear dependence relations Σ_(i)m_(j,i)v_(i)=0(j=1,2, . . . ) of all of them employing a discharging method; an ideal type classification process of acquiring said algebraic curve parameter file to make a reference to a ideal type table, which is composed of the record number field, the ideal type number field, a reduction order field, and the ideal type field, to retrieve a record in which the ideal type described in the ideal type field accords with the type of an input ideal J, and to acquire a value N of the ideal type number field and a value d of the reduction order field of the retrieved record; a polynomial vector generation process of, when said d is zero, outputting the input ideal J as said Groebner basis J*, when said d is not zero, to make a reference to a monomial list table, which is composed of the record number field, the order field, and the monomial list field, for retrieving a record R of which a value of the order field is said d, to acquire a list M₁, M₂, . . . of the monomial described in the monomial list field of said record R, to construct a defining polynomial F employing the coefficient list and the monomial order described in said algebraic curve parameter file, to acquire a first polynomial f, a second polynomial g, and a third polynomial h of the input ideal J, to calculate a remainder equation r_(i) of a product M_(i)·g of each said monomial M_(i) and said polynomial g by the polynomials f and F, to generate a vector w^((i)) ₁ that is composed of coefficients of the remainder equation r_(i) according to the monomial order described in said algebraic curve parameter file, furthermore to calculate a remainder equation s_(i) of a product M_(i)·h of each said monomial M_(i) and the polynomial h by the polynomials f and F, to generate a vector w^((i)) ₂ that is composed of coefficients of the remainder equation s_(i) according to the monomial order described in said algebraic curve parameter file, and to connect the above-mentioned two vectors w^((i)) ₁ and w^((i)) ₂ for generating a vector v_(i); and a basis construction process of obtaining a plurality of vectors m₁, m₂, . . . output in said linear-relation derivation process to make a reference to a table for a Groebner basis construction, which is composed of the record number field, the order field, the component number list field, the first vector type field, the second vector type field, and the third vector type field, for retrieving a record R₂ of which a value of the order field is said value d, and in which a vector of which the components that correspond to all component numbers described in the component number list field are all zero does not lie in said plurality of said vectors m₁, m₂, . . . , to select a vector m that accords with a first vector type of said record R₂ from among said plurality of said vectors m₁, m₂, . . . , to generate a polynomial f₁ of which a coefficient is a value of the component of the vector m according to the monomial order described in said algebraic curve parameter file, hereinafter, similarly, to generate a polynomial f₂ employing the vector that accords with a second vector type, and also a polynomial f₃ employing the vector that accords with a third vector type, to obtain a set {f₁,f₂,f₃} of the polynomial, and to output it as said Groebner basis J* or J**. 